What Are the 5 C's of Audit Findings?
Auditors write audit findings in five parts, the 5 C's: criteria, condition, cause, consequence and corrective action. Written that way, a finding is clear, actionable and ready to resolve:
1. Criteria
- Criteria are the standards or benchmarks against which your auditor evaluates performance or compliance: laws, regulations, policies or best practices. In a financial process, for example, the criteria might be adherence to Generally Accepted Accounting Principles (GAAP).
2. Condition
- The condition is the current state your auditor found during the audit, what it observed. For instance, financial records might be missing required documentation, or staff might not have followed procedures. State it accurately so stakeholders understand the scope of the issue.
3. Cause
- The cause is why the condition exists: the underlying reason, such as inadequate training, resource constraints or ineffective internal controls. Pinpoint it so you can address the root problem.
4. Consequence
- The consequence is the potential or actual impact of the condition: financial loss, regulatory penalties, reputational damage or operational inefficiency. State it so the reader addresses the finding promptly.
5. Corrective Action
- Corrective action is the steps you take to address the issue and prevent it from recurring: additional training, updated policies or stronger internal controls, for example. Make each step specific, realistic and actionable.
Why Are the 5 C's Important
Auditors use the 5 C's to document and address audit findings in a set structure, so each finding is:
Clear: Stakeholders can easily understand the issue.
Actionable: Solutions are practical and achievable.
Comprehensive: root cause to impact, in one finding.
An audit finding example, written out in the 5 C's
We wrote one finding in the 5 C's of audit findings, from the standard to the fix:
One finding, five parts
Illustrative example, not a client matter
CRITERIA
Company policy requires a second approver for any invoice over $5,000.
CONDITION
12 of the 40 invoices we sampled above that amount had one approver.
CAUSE
In March, the purchasing team changed the system so one approver could release payment.
CONSEQUENCE
The company paid those invoices without the second review the policy requires.
CORRECTIVE ACTION
Restore the second-approver rule in the system, then re-test a new sample next quarter.
Owner and date agreed.
What is an audit finding
Your auditor records an audit finding when it finds a gap between the criteria that apply and the condition in a control, a process or a balance.
You will also hear finding used alongside recommendation, observation and opinion, and they differ. Your auditor gives one opinion on your financial statements as a whole. It reports findings on the issues it judges significant, with a recommendation inside each, and may pass lesser points to management as observations in a management letter.
Significant deficiency vs material weakness
In a financial statement audit, your auditor rates each internal control deficiency it finds. Under AU-C section 265, your auditor reports two of those levels in writing to those charged with governance:
| Significant deficiency | Material weakness | |
|---|---|---|
| What it is | A deficiency, or a combination of them, less severe than a material weakness | A deficiency, or a combination of them, at the top level of severity |
| The test | Important enough to merit the attention of those charged with governance | A reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis |
Your auditor judges severity by the potential for a misstatement, so it can rate a deficiency at either level even where no misstatement occurred.
How to respond to an audit finding
Your auditor includes your response in the report, so write it before the report is final:
- Step 01
Say whether you agree.
State your agreement in a sentence, or give a detailed explanation of the reasons you disagree. Under GAGAS your auditor reports your view either way, and reports it if you decline to respond.
- Step 02
Name the owner, the action and the date.
For each finding, write who is responsible for the corrective action, what you will do and when you expect to finish.
- Step 03
Keep the plan separate from the report.
In a Single Audit, you file the corrective action plan as its own document under 2 CFR 200.511. Give each finding the auditor's reference number, and include financial statement findings as well as federal award findings.
- Step 04
Report what happened last year.
If a prior finding is still open, say why it recurred and what you have done so far. In a Single Audit, you report that in the summary schedule of prior audit findings.
Your auditor tests the corrective action at the next audit, so promise only what you will do.
Findings reviewed before your board meeting
Send us the draft findings and your management response. We will tell you which findings your auditor can support and what the corrective action must show.
The 4 C's, the 5 C's and CCCER
The 4 C's.
You give criteria, condition, cause and consequence, and leave management's response outside the finding itself.
The 5 C's.
You give criteria, condition, cause, consequence and corrective action as the five parts.
CCCER.
You give criteria, condition, cause, effect and recommendation, renaming consequence as effect and corrective action as recommendation.
You will meet overlapping labels, and audit functions differ over where they put the recommendation and the agreed action. Ask which version your audit function uses before you write your first finding, so your reports stay consistent.
500+
completed audits
50
states served
AICPA
peer-reviewed firm
16+
years in audit
Firm figures as of September 2026, from the Dimov Audit homepage.
Audit services
Treat the information as general, and ask a CPA about your own findings before you act on them.
Talk to an auditor about your findings
Send us the findings you are working through and the standard they were raised against. We will tell you what to put in the corrective action and how we would test it.
Contact
Connect with Dimov Audit
Our dedicated team is ready to assist you on your path to financial success.
24 Mercer St, 2nd Floor, Suite 214
New York, NY 10013
United States
Reviewed by George Dimov, CPA. Dimov Audit performs financial statement audits and other attestation work for companies and nonprofits across all 50 states. Profile