—IIA 2024 · Standard 14.3
Standard 14.3: evaluation of findings.
A gap between criteria and condition is only a potential finding. Standard 14.3 asks auditors to evaluate each one for significance — weighing likelihood and impact — to work with management on the root cause where possible, and to prioritise every finding using the chief audit executive's methodology.
—What the Standards Require
The requirements, in plain terms.
Standard 14.2 · Context
Analyses and potential findings
Auditors compare the criteria with the condition — the actual state. Any gap is a potential finding to be evaluated.
Standard 14.3
Evaluate significance
Each potential finding is evaluated for significance, considering the likelihood of the risk and its impact on governance, risk management or control.
Standard 14.3 · Root cause
Root cause, with management
Auditors work with management to identify root causes when possible, and to determine potential effects.
Standard 14.3 · Prioritisation
Prioritise by methodology
Significant risk exposures are documented and communicated as findings, and each finding is prioritised by significance using the CAE's methodology.
Standard 14.4 · Context
Recommendations and action plans
Recommendations or agreed actions should close the gap, bring risk to an acceptable level, address the root cause or improve the activity.
—In Practice
What it looks like when it's done well.
One rating scale, every engagement
A rating or ranking set by the CAE's methodology keeps findings consistent across engagements and auditors — so a "high" in treasury means the same as a "high" in procurement, and the committee can compare them.
The elements of a finding
The Considerations suggest a structure: criteria, condition, root cause (when possible), effect, and significance and prioritisation. It is guidance rather than a mandate, but it is what most assessors expect to see.
Ask why until it stops changing
Root-cause analysis means asking why the gap exists until the answer stops moving. A finding that only describes the symptom invites a fix that only treats the symptom — and the same finding next year.
—Evidence of Conformance
What an assessor will ask to see.
Working papers that state the evaluation criteria used (14.3)
For each finding: criteria, condition, root cause, effect and priority (14.3)
The documented rating methodology, including materiality and risk tolerance considered (14.3)
The final engagement communication showing findings prioritised by significance (14.3)
How ControlVista Supports It
VistaResolve — Findings & Remediation
Observations are staged with severity, ownership and management response, and VistaAssist's Finding Narrator drafts the condition, criteria, cause, effect and recommendation for the auditor to edit — so every finding follows the same structure.
—IIA 2024 Hub
More on the Standards.
—Frequently Asked
Questions audit leaders ask.
Is root-cause analysis mandatory under the IIA 2024 Standards?
Standard 14.3 requires auditors to work with management to identify root causes when possible. It is a requirement qualified by feasibility, not an absolute one.
What are the elements of an audit finding?
The Considerations for Standard 14.3 suggest criteria, condition, root cause (when possible), effect, and significance and prioritisation. They are presented as guidance rather than a mandatory template.
Last reviewed October 2026. Standards references paraphrase The IIA's Global Internal Audit Standards (2024); they are not a substitute for the official text.
—Request a demo
See ControlVista run your audit lifecycle, end to end.
A 30-minute walkthrough with the team that built it — from the audit universe to the board-ready committee pack, in English and Arabic.
A product of Vantage Technologies.