Findings and review

An Auditor prepares a finding with a description, evidence reference and response due date. The finding links to an assessment, business unit and organization. Together those details let the Audit Manager understand the issue, locate its support and identify the operating area expected to respond. A broad description such as access problem needs enough explanation to guide a useful management response.

The finding review action approves the finding and records a review decision with an operation receipt. The team can inspect the decision reason and reviewer alongside the working record. Keep the evidence reference meaningful to the people who will revisit the matter later. When the evidence lives in another repository, rehearse access with the reviewer before the first approval meeting.

• Finding preparation. The Auditor describes the issue and checks the assessment and business unit links. The response due date gives the Control Owner a clear follow-up point.
• Approval review. The Audit Manager reads the supporting evidence before approving a finding awaiting review. The decision record explains the judgment and identifies the reviewer.
• Follow-up workload. Findings Past Due and Findings Board help the team inspect response dates and current states. Open the underlying finding before deciding what action is appropriate.

Agree what evidence the Audit Manager requires before approval and who can submit a finding for that review. Define how a Return or Reject decision is recorded and how the Auditor responds to the reason. The team should know which part of the description needs revision before sending the finding through another review cycle.

Also agree how to handle a disputed finding and when to revise a response date. Preserve a useful explanation in the working record or decision notes. Set the appropriate access for business unit participants so the Control Owner can see the finding being discussed. Confirm how reviewers identify themselves when recording decisions and how that identity relates to their signed-in account.

Prepare a supplier access finding for the current assessment. The Auditor records the evidence reference and explains which reviewed access change needs a response. Set a response due date and place the finding in Pending Approval. The Audit Manager opens the evidence, checks the business unit and decides whether the explanation supports approval.

If the evidence is insufficient, record a Return decision with a clear reason and ask the Auditor to revise the support under the agreed procedure. For the approval case, run the review action and inspect the Approved finding, decision record and operation result. Then open the finding from the workload view to confirm that a colleague can follow the same evidence without relying on the meeting conversation.

• Findings Pending Approval — Read findings waiting for the Audit Manager’s decision.
• Findings Past Due — Inspect response dates that have reached today or passed it.
• Findings Board — Discuss the finding workload by its current recorded state.

Rehearse finding review, then continue with corrective response and retest.