Criteria versus Condition and Significance of Findings

Introduction
In the CIA Challenge Exam, the Engagement Performance domain tests whether you can turn evidence into well-supported, useful findings. Two ideas sit at the center of this skill. The first is telling criteria (what should be) apart from condition (what is). The second is judging the significance of a finding, which decides whether and how it is reported. This guide explains why these concepts matter, what they mean, how they work in practice, and how to answer exam questions on them with confidence.

Why This Topic Is Important
Every audit finding rests on a comparison. An internal auditor looks at a standard, looks at reality, and identifies the gap. If the auditor confuses the standard with reality, the finding falls apart.

Getting this right matters for several reasons:
• Credibility of the audit function. Management will push back on findings that do not clearly separate what was expected from what was found. A finding without valid criteria is just an opinion.
• Conformance with the Standards. The IIA's Global Internal Audit Standards (and the earlier IPPF guidance) expect internal auditors to identify, analyze, evaluate, and document enough information to support engagement results. Findings must be grounded in suitable criteria. Under the current Standards, criteria are addressed in Principle 13 (Plan Engagements Effectively) and findings in Principle 14 (Conduct Engagement Work).
• Prioritization. Significance helps the chief audit executive (CAE), senior management, and the board focus on what matters most. Not every exception deserves the same attention.
• Effective remediation. A clearly stated gap, rated correctly, leads to recommendations and action plans that fit the real risk.
• Exam weight. The CIA Challenge Exam often gives you a scenario and asks you to label an element of a finding or decide whether it is significant. These questions are very common and can be answered reliably once you know the framework.

What It Is: The Elements of a Finding
An audit finding (also called an observation) is traditionally made up of four or five attributes, often called the 5 Cs:

1. Criteria: What should be. This is the standard, benchmark, or expectation used to judge the activity. Examples include:
• policies and procedures
• laws and regulations
• contracts and service-level agreements
• budgets and targets
• industry best practices and control frameworks (such as COSO)
• management's stated objectives

2. Condition: What is. This is the factual evidence the auditor found during the engagement. It is the actual state of affairs, for example: '12 of 40 sampled purchase orders above $10,000 were approved by only one signatory.'

3. Cause: Why the gap exists. This is the root reason the condition differs from the criteria. Examples include a lack of training, an unclear policy, a system design flaw, or deliberate override.

4. Effect (Consequence): So what? This is the risk or exposure created by the gap, such as financial loss, compliance penalties, reputational damage, or inefficiency. Effect is the key driver of significance.

5. Corrective action (Recommendation): What should be done. The Global Internal Audit Standards now call these recommendations and management action plans. They address the cause, not merely the symptom.

A simple memory aid:
• Criteria = Standard (Should)
• Condition = Situation (Is)
• Cause = Source (Why)
• Effect = So-what (Impact)

Criteria versus Condition: The Core Distinction
The exam frequently disguises these two elements. Use these tests:

• Criteria are normative. They use words like should, must, required, policy states, target is, regulation mandates, expected. Criteria exist before the auditor arrives. Ideally they are agreed with management during engagement planning.

• Condition is factual and observed. It uses words like was found, testing revealed, auditors observed, X of Y items, actual results show. A condition is discovered during fieldwork and is supported by evidence.

Example scenario:
'Company policy requires that all user access be reviewed quarterly. The auditor found that the last access review was performed 11 months ago. Staff turnover in the IT security team left no one assigned to the task. As a result, 23 terminated employees still had active system accounts.'
• Criteria: quarterly access reviews required by policy.
• Condition: last review 11 months ago.
• Cause: staff turnover and no assigned owner.
• Effect: 23 terminated users with active access, creating a risk of unauthorized transactions or data breach.

When criteria are missing or unclear
Sometimes no formal standard exists. The Standards expect internal auditors to identify suitable criteria. If management's criteria are inadequate, auditors should work with management to develop appropriate evaluation criteria. Useful sources include:
• leading practices
• regulatory guidance
• professional frameworks
• benchmarking against peers

An auditor should not report a finding without a defensible basis for 'what should be.' Exam answers that suggest the auditor invent personal preferences as criteria are usually wrong.

Characteristics of good criteria:
• relevant
• reliable
• objective (neutral)
• understandable
• complete
• ideally agreed with management in advance

Characteristics of a well-supported condition:
• based on sufficient evidence (enough of it)
• reliable evidence (trustworthy, ideally from independent sources or direct observation)
• relevant evidence (logically related to the objective)
• useful evidence (helps the organization achieve its goals)

Significance of Findings: What It Is
Significance is the relative importance of a finding in the context in which it is being considered. It includes both quantitative and qualitative factors. The current Standards direct internal auditors to evaluate the significance of each finding and to prioritize findings, typically using a rating such as high, medium, or low. Significance determines:
• whether a finding is reported formally in the final engagement communication
• whether it is communicated informally (for example, verbally or in a management letter)
• whether it is escalated to senior management or the board
• the urgency of corrective action

How Significance Works: Factors to Consider

Quantitative factors:
• dollar amount of the error or exposure relative to a materiality threshold
• frequency or error rate (for example, a 30% exception rate versus 1%)
• volume of transactions affected
• projected misstatement when sample results are extrapolated to the population

Qualitative factors:
• fraud or illegal acts. These are usually significant regardless of amount.
• regulatory or legal non-compliance
• impact on achievement of key strategic or operational objectives
• reputational risk
• pervasiveness, meaning whether the issue is isolated or systemic
• whether a key control rather than a compensating control is affected
• involvement of senior management
• repeat findings not remediated from prior audits
• the organization's risk appetite and tolerance
• the likelihood and impact of the related risk

Likelihood and impact
Significance is often assessed using risk-based reasoning: how likely is it that the gap leads to an adverse outcome, and how severe would that outcome be? A low-dollar exception in a high-risk area (such as cash disbursements or privileged IT access) may be more significant than a larger exception in a low-risk area.

Aggregation
Several individually minor findings can together indicate a significant control weakness. Auditors should consider whether findings combine into a pattern or theme, such as a weak control environment or poor tone at the top.

Reporting implications
• Significant findings are included in the final engagement communication with criteria, condition, cause, effect, and recommendations.
• Minor or insignificant findings may be communicated informally. They should still be documented in the working papers.
• Significant risk exposures and control issues, including fraud risks and governance issues, are reported periodically by the CAE to senior management and the board.
• If the CAE concludes that management has accepted a level of risk beyond the organization's risk tolerance, the CAE must discuss it with senior management. If unresolved, the CAE communicates the matter to the board.

How It Works in Practice: A Step-by-Step Process
1. During planning, establish the engagement objectives and identify evaluation criteria. Agree the criteria with management where possible.
2. During fieldwork, gather evidence to establish the condition. Use testing, observation, inquiry (corroborated), analytics, and inspection.
3. Compare condition to criteria. If they match, there is no finding; positive conditions can be acknowledged. If they differ, a potential finding exists.
4. Analyze the root cause so the recommendation fixes the underlying problem.
5. Assess the effect in terms of risk, cost, compliance, and objectives.
6. Evaluate significance using quantitative and qualitative factors.
7. Discuss with management to validate facts before final reporting. This reduces disputes and confirms that the condition is accurate.
8. Develop recommendations and obtain management action plans.
9. Report according to significance and follow up on implementation.

Common Pitfalls the Exam Tests
• Mistaking a policy statement (criteria) for a test result (condition).
• Mistaking the effect for the cause. For example, 'losses occurred' is an effect, while 'no supervisory review' is a cause.
• Treating dollar size as the only measure of significance and ignoring fraud, compliance, or reputational issues.
• Writing recommendations that address the condition but not the cause.
• Reporting findings without validating them with management first.
• Assuming the absence of formal criteria means no finding can be made, rather than developing suitable criteria.

Exam Tips: Answering Questions on Criteria versus Condition and Significance of Findings

Tip 1: Look for signal words.
• Should, must, policy requires, standard, budget, target point to criteria.
• Found, observed, testing showed, actual point to condition.
• Because, due to, resulted from a lack of point to cause.
• Resulting in, exposes the organization to, could lead to point to effect.

Tip 2: Ask yourself 'Should, Is, Why, So what?'
Mentally map every sentence in a scenario to one of these four questions before reading the answer choices.

Tip 3: Effect drives significance.
If a question asks which element best helps management judge the importance of a finding, the answer is usually the effect. If it asks which element is needed to develop an effective recommendation, the answer is usually the cause.

Tip 4: Qualitative factors can override small amounts.
When a scenario involves fraud, illegal acts, senior management, regulatory breaches, or repeat findings, lean toward treating it as significant even if the dollar value is immaterial.

Tip 5: Consider pervasiveness and aggregation.
Choose answers that recognize systemic patterns over answers that treat related exceptions as isolated, unless the facts clearly show a one-off event.

Tip 6: Criteria must be suitable and agreed.
Prefer answers in which the auditor uses established, objective standards and discusses them with management during planning. Reject answers where the auditor relies on personal opinion. Also reject answers where the auditor drops the engagement simply because no formal policy exists.

Tip 7: Evidence quality supports the condition.
If asked what makes a condition credible, think sufficient, reliable, relevant, and useful evidence. Independent, documented evidence is stronger than uncorroborated verbal statements.

Tip 8: Know where findings go.
• Significant findings go in the formal report.
• Insignificant findings may be communicated informally.
• Significant risk exposures go to senior management and the board.
• Unacceptable accepted risks are discussed by the CAE with senior management, then with the board if unresolved.

Tip 9: Validate before reporting.
Correct answers often include discussing the condition with management before issuing the report. This confirms the facts and supports a balanced communication.

Tip 10: Eliminate distractors that confuse elements.
Many wrong options are attractive because they describe a real element but label it incorrectly. Re-read what is being asked: criteria, condition, cause, effect, or significance.

Tip 11: Remember the 'best' answer principle.
CIA questions often contain more than one plausible option. Choose the one most aligned with the Standards: risk-based, objective, evidence-supported, and focused on root cause and organizational objectives.

Quick Practice Example
An auditor notes that the travel policy limits hotel costs to $200 per night. Testing shows 15% of claims exceeded the limit, totaling $4,000 for the year. Two of the exceptions were claims by the CFO that also lacked receipts. Which factor most increases the significance of this finding?
• Best answer: the CFO's involvement and missing receipts. These are qualitative factors suggesting a possible tone-at-the-top issue and fraud risk. They outweigh the small dollar total.
• The $200 limit is the criteria.
• The 15% exception rate is the condition.

Summary
Criteria tell you what should be, and condition tells you what is. The gap between them, explained by cause and measured by effect, forms the finding. Significance, judged through both quantitative and qualitative lenses, determines how the finding is prioritized and communicated. Master the signal words, remember that effect drives significance and cause drives recommendations, and always weigh qualitative red flags. With these habits, you will handle this area of the CIA Challenge Exam with accuracy and confidence.