Audit Findings Explained: Definition, Types, and Examples

Last reviewed: September 2026.

An audit finding is a documented result of an audit that shows whether a process, control or record meets the requirement it is measured against. Most findings describe a gap: a control that did not work, a policy nobody followed, or evidence that was missing. ISO 19011, the international guideline for auditing management systems, treats findings as the result of comparing audit evidence with audit criteria, so a finding can also confirm that something works.

Findings are normal. Almost every first audit produces some. What matters is how serious each one is and how quickly and permanently you fix it.

What Is an Audit Finding?

An audit finding is the auditor's written conclusion about one specific thing they tested. It says what the rule was, what they actually saw, and whether the two match.

Findings come in two broad kinds:

• Conformity: the requirement is met. Auditors often do not write these up in detail.
• Nonconformity (or deficiency, or exception): the requirement is not met, or only partly met. This is what people usually mean by "an audit finding".

Every finding must rest on evidence: a record, a system log, a sample, an interview. No evidence, no finding.

Audit Finding vs Observation

An observation is a softer note. It points out a weakness or an improvement opportunity, but nothing is broken yet.

	Audit finding (nonconformity)	Observation
What it means	A requirement is not met	A requirement is met, but there is a risk or a better way
Must you respond?	Yes, with a correction and corrective action	Usually no formal response
Can it block certification or a clean report?	Yes, if serious	No
Other names	Deficiency, exception, nonconformity	Opportunity for improvement (OFI), comment

Ignored observations often become findings at the next audit.

The 5 Elements of an Audit Finding (the 5 C's)

A well-written finding has five parts, often called the 5 C's:

• Criteria: the rule you are measured against (a law, a standard, a control, your own policy).
• Condition: what the auditor actually found.
• Cause: why the gap exists.
• Consequence (or effect): what could happen if it is not fixed.
• Corrective action: what will be done to fix it and stop it coming back.

Government auditors often use a close cousin: condition, criteria, cause, effect and recommendation.

Audit Finding Example (Written Out)

Here is how one real-world style finding looks in a SOC 2 audit, written with the 5 C's:

Element	Example
Criteria	SOC 2 control CC6.2 and the company's access policy: access for leavers is removed within 24 hours of their last day.
Condition	In a sample of 25 leavers, 3 still had active accounts in the production cloud console 9 to 21 days after leaving.
Cause	Offboarding tickets from HR did not reach the engineering team. Access removal was manual.
Consequence	Former staff could have reached customer data. The SOC 2 report lists this as an exception.
Corrective action	Connect the HR system to single sign-on so access ends automatically; run a weekly check for leftover accounts. Owner: IT lead. Due: 30 days.

What Are the Types of Audit Findings?

Most audits sort findings into three levels: serious, minor, and observations. The names change with the type of audit:

Audit type	Most serious	Middle	Least serious
Financial statement audit (US)	Material weakness	Significant deficiency	Control deficiency
ISO 27001 and other ISO audits	Major nonconformity	Minor nonconformity	Observation or opportunity for improvement
SOC 2 audit	Qualified or adverse opinion	Exception noted in the report	Informal recommendation (not in the report)
FDA and GMP inspections	Critical finding	Major finding	Minor finding

In US financial audits, a material weakness means there is a reasonable possibility that a material misstatement will not be prevented or caught in time. In ISO audits, a major nonconformity means the management system may not achieve its intended results. Either one needs urgent attention.

Many teams also track findings by severity:

1. Critical Findings

A direct threat to safety, customers or legal standing. They need action within days and can stop operations. Examples: falsified records, a total failure of a key control.

2. Major Findings

A significant control or process failure that is not an immediate emergency. They usually have a fixed deadline, often within 90 days. Examples: no access reviews for a year, no documented risk assessment.

3. Minor Findings

An isolated or low-risk gap, such as one missed training record or a policy that is a few months out of date. Minor findings are easy to fix, but a pile of them can point to a bigger problem.

4. Observations

Improvement suggestions, not violations. They are usually closed after discussion at the end of the audit.

5. Repeat Findings

A finding that was supposedly fixed but came back. Auditors treat repeats as a sign the root cause was never addressed, and often raise the severity.

Common Audit Findings in SOC 2 and ISO 27001 Audits

For software and cloud companies, the same handful of findings come up again and again in SOC 2 and ISO 27001 audits:

• Leavers keep access: accounts not removed on time after someone leaves.
• Access reviews missing: quarterly reviews skipped, or done with no evidence.
• MFA gaps: admin or production accounts without multi-factor authentication.
• Change management: code or infrastructure changes deployed without recorded approval or testing.
• Vendor reviews: key suppliers never assessed for security.
• Training: security awareness training not completed by all staff.
• Backups: backups taken but never test-restored.
• Incident response: a plan exists but has never been tested.
• Risk assessment: out of date, or missing for new systems.
• Policies: not approved, not reviewed yearly, or not acknowledged by staff.

Most of these are not missing controls. They are missing evidence that a control ran on time. That is why continuous evidence collection prevents so many findings. Our guide to ISO 27001 requirements covers the controls behind each one. For how these show up in a SOC 2 report, see our guide to SOC 2 audit exceptions.

Audit Finding Examples in Other Industries

Healthcare (HIPAA)

Typical HIPAA findings include sharing more patient information than needed, charging patients improper fees for their records, and releasing PHI without proper authorization. The stakes are real: as of October 2024, the HHS Office for Civil Rights had settled or imposed penalties in 152 cases totalling $144,878,972.

Financial Services

Common findings are weak separation of duties, inconsistent accounting practices and poor compliance documentation, especially around customer data protection and transaction monitoring.

Manufacturing

Findings often target quality systems that look fine on paper: outdated procedures, incomplete records and processes that were never updated when the work changed.

How to Write an Audit Findings Report

A clear audit findings report has four parts:

• Executive summary: scope, objectives and the most important findings.
• Findings: each one written with the 5 C's, the standard or control it relates to, and its severity.
• Management response: the team's agreement or disagreement and their action plan.
• Evidence: the records that support each finding.

ISO 19011 and ISO/IEC 17021-1 expect every finding to be based on evidence, tied to a specific requirement, and discussed with the auditee before the audit closes. Nobody should be surprised by the final report.

How to Respond to Audit Findings

Respond in writing, on time, with a plan that fixes the cause and not just the symptom:

1. Acknowledge the finding and confirm you understand it.
2. Contain the immediate risk (for example, disable the leftover accounts today).
3. Find the root cause with the 5 Whys or a fishbone diagram.
4. Plan corrective action with one named owner, a due date and the evidence that will prove it works.
5. Implement and verify that the fix works over time, not just once.
6. Close the finding with evidence the auditor can check.

Management Response Template

Field	What to write
Finding	[Reference and one-line summary]
Response	We agree / partly agree with this finding.
Root cause	[Why it happened]
Correction (now)	[What was fixed immediately]
Corrective action (lasting)	[What changes so it cannot happen again]
Owner and date	[Name], [target date]
Evidence of closure	[What the auditor will be able to review]

Timelines: the deadline depends on the audit. In ISO certification, major nonconformities must be corrected and verified before a certificate is issued, and the certification body sets the deadline. In regulated industries, deadlines can be days for critical findings.

The Lifecycle of an Audit Finding

1. Found and documented
2. Communicated to the owners
3. Root cause analysed
4. Corrective action implemented
5. Effectiveness verified
6. Formally closed with evidence
7. Monitored so it does not return

How to Prevent Repeat Findings

• Give each finding one owner, a person rather than a department.
• Build the fix into daily work, with automated checks rather than reminders.
• Collect evidence continuously, not in the weeks before the audit.
• Run a mid-year internal check on every past finding.
• Understand your audit risk. The audit risk model explains why weak controls lead auditors to test harder and find more.

Frequently Asked Questions

Turn Audit Findings Into Fewer Audit Findings

Audit findings are not a verdict on your company. They are a to-do list, and the best teams shrink that list every year. The pattern is simple: fix the root cause, give every fix an owner, and keep evidence flowing all year instead of scrambling before the auditor arrives.

UprootSecurity helps startups and scaleups do exactly that for SOC 2, ISO 27001, HIPAA and more. The platform monitors your controls continuously, collects evidence from your cloud, identity and HR tools automatically, and flags gaps like leftover accounts or overdue access reviews before an auditor finds them. Our compliance experts help you write management responses and close findings properly, so the same issue does not come back next year.

→ Book a demo today