A tester finds 7 of 60 purchase orders lacked a second signature. That is a fact, not yet a finding. Whether it belongs in the report, and how loudly, depends on what the policy required, why the gap happened, and what it could cost.
A finding is assembled from four parts, and the exam tests whether you can name which part a stem is describing.
- Criteria: the standard the condition should have met. Policy, procedure, contract term, regulation, or a management-set target.
- Condition: the factual state you observed and evidenced. What actually is.
- Cause: why the condition departed from the criteria.
- Effect: the consequence, actual or potential, of the departure.
Criteria minus condition equals the gap. Cause and effect explain and price it. A defensible recommendation follows from the cause, not from the condition.
KEY: No criteria, no finding. If you cannot name the standard that was violated, you have an observation of fact, not a difference. When management disputes a finding, the first attack is almost always on the criteria.
Common mistakes
- Reporting a condition with no criteria. "Reconciliations look sloppy" names no standard. Either cite the policy or report the absence of a defined standard as the finding.
- Stopping at the symptom. "Staff did not follow the procedure" is a restatement of the condition. Ask why until you reach a systemic, actionable reason.
- Ranking by dollars alone. A $31,000 override that breaches zero tolerance and repeats a prior finding outranks a larger one-off error.
Bottom line
- Every finding has four attributes: criteria (what should be), condition (what is), cause (why the gap exists), effect (what it costs).
- No criteria means no nonconformance; the absence of a required standard is itself a reportable finding.
- Criteria hierarchy: regulation, then internal policy, then industry practice; auditor preference alone is never criteria.
- Root cause is the systemic reason that, if corrected, prevents recurrence; the symptom is only what testing detected.
Exam shortcut
Sort the stem into the four attributes before reading the answer options. Whatever the question asks for, name it: "should have been" is criteria, "we observed" is condition, "because" is cause, "resulting in" or "could result in" is effect. Options that mislabel an attribute are the most common distractors. Stem signals: "no policy existed" means report the criteria gap, not a violation.
The full lesson (about 2,082 words, 14 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 6
Browse all free CIA Part 2 lessons or jump into free CIA Part 2 practice questions.