May 15, 2026

How to Write Audit Findings Reports for Review and Inspection

Amanda Waldmann

Increasing trust with AI for audit and advisory firms.

Key Insights

Strong findings reports are built around a defensible logic chain from criteria to consequence. Reports that skip a link are the ones reviewers and inspectors flag.
Documentation captured during fieldwork holds up better than cleanup afterward; the post-completion rule makes retroactive fixes expensive and visible.
Amended AS 1215 compresses the documentation completion window from 45 to 14 days starting December 2026.
AI-assisted drafting and assembly are where firms can claw back the time that change takes away.

An audit findings report documents the issues an engagement team identifies during fieldwork, along with the criteria, evidence, and reasoning behind each one. It is the artifact reviewers, audit committees, and inspectors look at when they want to understand what the team found and how they got there.

When the report doesn't let those readers follow the logic from evidence to conclusion, the engagement pays for it: review cycles drag, inspection risk goes up, and clients can't act on the findings as quickly. This article covers how to structure a findings report, where AI can reduce manual reporting work, and what policy guardrails firms should put around AI-assisted drafting.

The Importance of an Audit Findings Report

What separates a strong findings report from a vulnerable one is not length. A well-structured report lets any reviewer follow the logic from evidence to conclusion without requesting additional explanation. That reviewer might be a partner conducting engagement quality review today, or a PCAOB inspector examining the file three years from now.

The cost of getting reports wrong is measurable. The PCAOB regularly inspects audits of public companies and grades the work for compliance with auditing standards. When inspectors find that an audit lacked sufficient evidence to support its opinion, they flag it as a Part I.A deficiency, the most serious category of inspection finding. A CPA Journal analysis of 15 years of PCAOB inspection data found that in 2023, 55.3% of inspected engagements at Top 100 firms and 59.0% at all other firms had at least one Part I.A deficiency, and documentation gaps remain one of the clearest drivers of those numbers.

The Anatomy of an Effective Audit Findings Report

Findings reports are engagement-level documentation governed by standards like AS 1215, distinct from the formal auditor's report under AS 3101. Whether the engagement follows PCAOB or AICPA standards, the expectations converge: clear findings, traceable evidence, and defensible conclusions. Getting the structure right matters more than getting the prose polished. Weak structure slows signoff, increases rework, and makes an otherwise valid finding vulnerable during inspection.

The Four Cs Framework

The Four Cs (criteria, condition, cause, consequence) form the core of most audit finding structures.

Criteria: The standard, policy, or regulatory expectation the team tested against.
Condition: The observable facts the team discovered. State only what was found, without interpretation.
Cause: The root reason for any deviation between criteria and condition. This is where the report explains why the gap exists.
Consequence: The risk, financial impact, or operational exposure resulting from the gap. Clients need this to prioritize remediation.

Many internal audit frameworks, including IIA guidance, add a fifth C for corrective action or recommendation, which engagement teams include when they are responsible for recommending remediation.

Each element depends on the others. A finding without a stated cause gives the client no path to remediation. A finding without a documented consequence gives them no basis for prioritizing it. Reviewers and inspectors trace that same connection: if the link from criteria through consequence breaks, the finding is harder to defend regardless of how strong the underlying evidence is.

Documentation Requirements Under AS 1215

Structure matters, but it only holds up if the file behind it meets the documentation standard. PCAOB AS 1215 sets the baseline for what the documentation file must contain. At a minimum, the file needs to show what the team did, how far the procedures went, what evidence was obtained, and what conclusions were reached. It also needs to reflect the professional judgment behind those conclusions, which is where most review comments and inspection questions concentrate.

The requirement firms most often underestimate is the post-completion rule. If anyone adds to the file after the completion date, the addition must identify who made it, when, and why, and the original file must be preserved. That makes retroactive fixes expensive and visible, which is why firms increasingly look for ways to get documentation right during the engagement rather than cleaning it up afterward.

The amended AS 1215, effective for certain audits on or after December 15, 2026, reduces the period to assemble a complete and final set of audit documentation from 45 days to 14 days after the report release date. Firms that currently rely on the full 45-day period to finalize workpapers will likely need to rethink their close process before that deadline takes effect.

What Changes with AI-Powered Findings Reporting

A lot of reporting time has very little to do with judgment. Senior associates spend hours moving evidence references between files, formatting findings to match templates, and keeping language consistent across drafts. Partners and managers then spend their own hours reviewing those drafts, identifying inconsistencies, and sending them back for revision. The work is repeatable and rule-based, which is exactly where AI cuts hours and improves consistency at the same time.

AI takes that routine drafting and reference work off the team's plate. It can pull evidence references into the right place, generate first-draft language for criteria and condition sections, and apply consistent formatting across a set of findings. The team still reviews and applies judgment to the conclusions; what changes is how much manual assembly sits between the analysis and the final report.

How AI Helps Across Each Section of the Report

Where AI helps most depends on the section of the finding. Criteria and condition are data-assembly tasks; cause and consequence require more judgment. Here is how Fieldguide's AI features map to each part of the process.

Drafting Criteria and Condition

Writing the criteria section means locating the correct standard, regulation, or policy and stating it precisely. Writing the condition means summarizing what the team observed, with accurate references to evidence. Both tasks involve pulling information from multiple sources and assembling it into coherent prose.

Fieldguide's AI Actions can help here by generating outputs across an entire column of a workpaper sheet in one click using custom prompts. AI Actions applies multi-step reasoning with automatic context from documents and linked rows, and supports @mention references to other columns and shared data, so criteria and condition descriptions stay grounded in the engagement data attached to each item.

Cause and Consequence

Root cause analysis and impact assessment are often the most demanding parts of the finding to draft. They turn on engagement-specific facts. Distinguishing a training gap from a control design flaw from a resource constraint is not pattern recognition; it is judgment grounded in what the team saw on this engagement. The right place for AI here is to surface candidate causes from the evidence and tighten the language, not to draw the conclusion.

Fieldguide's AI Chat fits that role. At the Workspace level, AI Chat analyzes the workpapers attached to a specific workplan row and lets practitioners refine analysis in-chat before final conclusions are drafted. Chat outputs stay in the chat window by design, so the practitioner decides what makes it into the workpaper, after review.

Report Assembly and Cross-Referencing

Fieldguide's reporting workflows pull mapped findings data from workpapers into formatted report templates, reducing manual copy-paste and helping keep cross-references consistent. Because workpapers and reports live on the same platform, version control and formatting alignment stay intact without toggling between disconnected tools. That matters most at the assembly stage, where consolidating findings from individual workpapers into a single report and aligning formatting across sections consumes significant time without requiring much judgment.

Beyond assembly sits review. Field Reviewer, one of the Field Agents in the Agent Workforce, surfaces exceptions, judgment calls, and elevated-risk areas before a partner picks up the file. Where AI Assist takes routine assembly off the staff's plate, Field Reviewer takes routine pre-partner review off the manager's.

AI Guardrails for Findings Reporting

AI-assisted reporting works best when firms set clear policies for how teams use it.

The Regulatory Context in 2026

PCAOB projects show active attention to technology, quality control, and documentation, but auditing standards still do not provide a standalone framework for AI use in audit documentation. For now, firms own the design of review controls, evidence requirements, and documentation policy.

That's about to change. Amended AS 1215 and QC 1000 both take effect on December 15, 2026, with QC 1000 requiring firms to design a quality control system with documented risk responses. Starting with the 2027 inspection cycle, AI-assisted reporting workflows fall within the scope of what inspectors evaluate.

Building Your Firm's AI Reporting Policy

Firms that document how AI fits into their reporting workflows tend to get more consistent results from it and face fewer questions during review or inspection. A practical internal policy typically addresses three areas:

Permitted use: Which reporting tasks AI can support and which still require fully manual drafting or review.
Retention requirements: How the team retains support for AI-assisted work, so the firm can explain how a draft was produced if questions arise.
Accountability: Who owns the final document and signoff, since review discipline depends on clear ownership.

These align with core themes in the NIST AI RMF, which emphasizes governance, clear accountability for AI outcomes, and documented oversight mechanisms across the AI lifecycle. Fieldguide's platform supports this directly with ISO 42001 certification and full transparency into AI outputs, by showing the inputs, outputs, citations, and reasoning behind every AI run.

Strengthen Your Audit Findings Reports with Fieldguide

A defensible findings report comes from work that is connected end-to-end: planning, fieldwork, review, and reporting on the same platform with the same evidence trail. Fieldguide is the industry's only end-to-end AI-native platform purpose-built for audit and advisory, bringing together the Agent Workforce, methodology depth, and audit-grade rigor firms need to operate this way, with practitioners reviewing and applying professional judgment at every step. With the documentation window tightening before the 2027 inspection cycle, firms running engagements end-to-end spend less of that window reconciling artifacts and more of it on the work inspectors actually evaluate. Firms looking to prepare for that deadline can contact us to see how this looks in practice.