Twelve small findings sit on the workpaper index. Eleven are isolated clerical slips. The twelfth is the same root cause showing up in eleven places. Whether the engagement conclusion reads "controls are generally effective" or "controls are not effective" depends entirely on which reading you defend.
A finding is a single documented gap between condition and criteria, supported by cause and effect. A conclusion is the engagement-level professional judgment about whether the governance, risk management, and control processes under review achieve their objectives. Findings are inputs. The conclusion is an output that no single finding produces by itself.
The bridge between them is aggregation, the deliberate step of reading the finding population as one body of evidence rather than a list. Aggregation runs before the closing communication is drafted and before ratings are assigned.
KEY: You never conclude by counting. Three findings can produce an unsatisfactory conclusion and fifteen can produce a satisfactory one. Significance, not volume, drives the conclusion.
Common mistakes
- Counting findings instead of weighing them. Twelve low-severity findings with no shared cause do not compel a negative conclusion; two findings breaching tolerance do.
- Failing to aggregate a shared root cause. Reporting 14 receipt gaps, 9 approval gaps, and 6 duplicates separately hides the single 14.5% workflow defect and the $61,400 exposure.
- Concluding beyond the scope tested. A conclusion on one process, entity, or period cannot be stated as an enterprise-wide opinion.
Bottom line
- Findings are inputs; the conclusion is an engagement-level judgment on whether governance, risk management, and control processes achieve objectives.
- Significance drives conclusions, not the number of findings.
- Aggregation lenses: severity, likelihood, root-cause commonality, pervasiveness, persistence, comparison to risk tolerance, compensating controls, nature of the control.
- Individually minor findings sharing one root cause aggregate into a single significant finding.
Exam shortcut
Read the stem for a shared cause before you rate anything. Words like "all traced to," "the same configuration," or "in each case the approver was untrained" mean aggregate first, then judge severity on the combined exposure. Answer choices that report the symptoms separately are constructed wrong answers.
The full lesson (about 2,011 words, 13 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 8
Browse all free CIA Part 2 lessons or jump into free CIA Part 2 practice questions.