Evaluating Audit Evidence & Determining Findings

Lesson 6 covered how to collect credible evidence. This lesson covers the step that turns collected evidence into an actual audit finding — and why that step is where a surprising amount of audit quality is won or lost.

What a finding actually is

An audit finding is the result of evaluating collected evidence against audit criteria — nothing more, and nothing less. This definition matters because it excludes two things people sometimes mistake for findings:

• A raw fact alone isn't yet a finding ("the SIEM logged 340 alerts last month" is a fact; whether that indicates conformity or a gap depends on evaluating it against a specific criterion, like whether alerts are meant to be reviewed within a defined timeframe).
• A personal opinion isn't a finding either ("I don't think this team takes security seriously" is an impression, not something traceable to specific evidence evaluated against a specific criterion).

A finding is always the output of a specific process: evidence, evaluated against criteria, produces a conclusion of conformity or nonconformity (or, in some frameworks, an observation — covered in the next lesson) for that specific criterion.

The evaluation process

For each checklist item (Lesson 4), the process is roughly: gather evidence (Lesson 6) → compare what the evidence actually shows against what the specific criterion requires → reach a conclusion. The critical discipline is keeping these steps separate and in order — an auditor who has already formed a conclusion (perhaps from a first impression, or from a prior audit's history with this client) and then selectively gathers evidence to support it has reversed the process, and violated both the evidence-based approach and fair presentation principles from Lesson 1.

When evidence is genuinely inconclusive

Not every checklist item resolves cleanly. Sometimes the evidence gathered is genuinely insufficient to support either a conformity or nonconformity conclusion — perhaps the sample was too small, or the relevant records weren't available during the audit window. The correct response to inconclusive evidence isn't to force a conclusion in either direction to avoid an awkward gap in the report; it's to document that the evidence was insufficient and, where the objective and timeline allow, seek additional evidence (an expanded sample, an additional interview) before the audit concludes. Reporting a conformity finding on genuinely thin evidence is just as much a violation of evidence-based approach as reporting an unsupported nonconformity.

Separating fact from inference in practice

A useful discipline: write down the specific fact observed, separately from the conclusion drawn from it, and check that the conclusion actually follows. "The access review log shows the Q2 review was completed 11 days after its scheduled date" is a fact. "This is a nonconformity against the policy's stated 5-business-day review window" is the finding — and it only holds if the criterion (the policy's stated window) is correctly cited and the fact genuinely falls outside it. An auditor who writes "reviews seem inconsistently timed" without citing the specific criterion and the specific dates has blurred fact and inference into something a report reviewer can't actually verify.

Why this step deserves real care

Every subsequent stage of this roadmap — classifying nonconformities (next lesson), writing the report, and the closing meeting — depends entirely on findings that were reached soundly at this stage. A rushed or sloppy evaluation here doesn't just risk one wrong finding; it risks the credibility of the entire audit, since a report reviewer (or a certification body's own internal quality process) who spots one finding that doesn't actually trace back to its cited evidence has reason to scrutinize every other finding in the same report far more skeptically.