Criteria, Condition, Cause, and Effect in Findings
5 minutes
5 Questions
In the Certification in Risk Management Assurance (CRMA) framework, particularly when communicating risk management assurance results, findings are structured around four essential elements: Criteria, Condition, Cause, and Effect. These elements, often called the 'Four Cs' (plus Effect), align with IIA Standard 2410 and ensure findings are clear, persuasive, and actionable. Criteria represent the standards, measures, or expectations used to evaluate risk management activities. These answer the question 'What should be?' Criteria may include policies, procedures, regulatory requirements, risk appetite statements, industry frameworks such as COSO ERM or ISO 31000, or management's own stated objectives. Well-defined criteria give the finding legitimacy and provide a benchmark against which performance is judged. Condition describes the factual evidence the auditor or assurance provider actually found during the engagement. It answers 'What is?' The condition must be objective, verifiable, and supported by sufficient evidence. For example, a condition might state that risk assessments were not updated in three business units during the past year despite a policy requiring annual refreshes. Cause explains why the gap between criteria and condition exists. It answers 'Why did it happen?' Identifying root cause rather than symptoms is critical because recommendations addressing only symptoms rarely produce lasting improvement. Causes may include inadequate training, unclear accountability, resource constraints, poor system design, or weak oversight. Effect identifies the actual or potential impact of the condition on the organization. It answers 'So what?' Effect communicates risk exposure in terms stakeholders understand, such as financial loss, regulatory penalties, reputational damage, operational disruption, or failure to achieve strategic objectives. Quantifying effect where possible strengthens the case for action. Together, these elements create a logical narrative: the gap between criteria and condition, driven by a cause, produces an effect. This structure enables management to understand the issue, accept ownership, and implement meaningful corrective actions, while helping boards and audit committees prioritize risks appropriately.
Criteria, Condition, Cause, and Effect in Findings (IIA CRMA – Communicating Risk Management Assurance)
Why This Topic Matters
In the IIA Certification in Risk Management Assurance (CRMA) exam, the domain on Communicating Risk Management Assurance tests your ability to turn observations about risk management processes into clear, actionable findings. The IIA's International Professional Practices Framework (IPPF), specifically Standard 2410 (Criteria for Communicating) and the related implementation guidance, describes the elements of a well-constructed observation: criteria, condition, cause, and effect, usually followed by a recommendation or management action plan. Internal auditors often remember this as the "4 Cs" or the "C-C-C-E" model.
Why does it matter? A finding that merely says "controls are weak" gives management nothing to act on. A finding that states what should be (criteria), what is (condition), why the gap exists (cause), and what it means for the organization (effect) allows the board, senior management, and risk owners to understand the significance of the issue, prioritize remediation, and fix the root problem rather than the symptom. For a risk management assurance provider, this structure is the bridge between assessing the effectiveness of risk management and influencing improvement in governance, risk management, and control.
What the Four Elements Are
1. Criteria – "What should be"
Criteria are the standards, measures, expectations, or benchmarks used to evaluate the matter under review. In risk management assurance, criteria may include: the organization's risk management framework or policy, the board-approved risk appetite statement, COSO ERM or ISO 31000 principles, laws and regulations, contractual requirements, industry leading practices, key risk indicator (KRI) thresholds, and management's own documented procedures. Criteria should be agreed with management during planning wherever possible. If no suitable criteria exist, the internal auditor must work with management and/or the board to identify appropriate criteria (Standard 2210.A3).
2. Condition – "What is"
The condition is the factual evidence the auditor found during the engagement – the actual state of affairs. It must be objective, verifiable, and supported by sufficient, reliable, relevant, and useful information (Standard 2310). Example: "Risk registers for three of the five business units reviewed had not been updated in over 18 months, although policy requires quarterly updates." Conditions are stated without blame or opinion; they describe observed facts.
3. Cause – "Why the difference exists"
The cause explains the reason for the gap between the criteria and the condition. This is the most analytically demanding element because the auditor must identify the root cause, not just the surface symptom. Typical root causes include: unclear roles and responsibilities, inadequate training, insufficient resources, poorly designed processes, lack of management oversight, weak tone at the top, misaligned incentives, or system limitations. Root cause analysis techniques such as the "5 Whys," fishbone (Ishikawa) diagrams, and Pareto analysis are useful. Addressing the root cause prevents recurrence; addressing a symptom does not.
4. Effect – "So what?"
The effect is the risk or exposure the organization faces because the condition differs from the criteria. It answers the question "why should management care?" Effects may be actual (losses already incurred) or potential (exposure to loss, non-compliance, reputational damage, missed objectives, inaccurate risk reporting to the board, decisions made on stale risk information). Quantify effects where practical (financial amounts, number of transactions, percentage of population) because quantification helps management prioritize. The effect links the finding to the organization's objectives and risk appetite, which is central to risk management assurance.
Recommendation / Management Action
Although not one of the four core elements, findings are normally completed with recommendations or agreed management action plans, including a responsible owner and target date. Good recommendations address the cause, are cost-effective, and are proportionate to the effect.
How the Model Works in Practice
Think of the four elements as a logical chain:
• The gap between Criteria and Condition establishes that a finding exists.
• The Cause explains the gap and tells you where to aim the fix.
• The Effect justifies the significance and drives prioritization.
• The Recommendation closes the loop by targeting the cause.
Worked example (risk management assurance context):
Criteria: The enterprise risk management policy requires each business unit to assess emerging risks and report any risk exceeding appetite to the Risk Committee within 30 days.
Condition: Testing identified four risks rated "above appetite" in business unit registers that were not escalated to the Risk Committee; the average delay was 95 days.
Cause: Risk owners were unaware of the escalation requirement because the policy update was not communicated, and no system workflow flags above-appetite ratings.
Effect: The Risk Committee and board made resource allocation decisions without knowledge of four significant exposures, undermining the reliability of risk reporting and potentially exposing the organization to unmitigated losses estimated at up to $2 million.
Recommendation: Management should communicate the escalation requirement to all risk owners, deliver targeted training, and configure the GRC system to automatically alert the risk function when ratings exceed appetite.
Also note the related IIA guidance: communications must be accurate, objective, clear, concise, constructive, complete, and timely (Standard 2420). Positive observations and satisfactory performance should also be acknowledged where appropriate (Standard 2410.A2), and the engagement opinion or conclusion should be supported by the findings taken together.
How to Answer Exam Questions on This Topic
CRMA questions on this area are typically scenario-based. You may be given a short narrative and asked to identify which element is described, which element is missing, which statement is the best-written version of an element, or what the auditor should do next. The key skill is to classify statements correctly and to recognize weak versus strong findings.
Exam Tips: Answering Questions on Criteria, Condition, Cause, and Effect in Findings
1. Use the four signature questions. Criteria = "What should be?" Condition = "What is?" Cause = "Why did it happen?" Effect = "So what – what is the risk or impact?" Map every statement in the scenario to one of these before reading the answer options.
2. Spot criteria by looking for a standard or requirement. Words such as "policy requires," "regulation mandates," "framework states," "best practice suggests," or "the risk appetite statement limits" signal criteria. Remember that criteria should ideally be agreed with management, and if none exist, the auditor must help identify them – not simply drop the issue.
3. Spot condition by looking for observed, factual evidence. Phrases such as "testing revealed," "the auditor observed," "12 of 40 samples," or "records show" indicate condition. The condition must be supported by evidence; an unsupported assertion is not a valid condition.
4. Distinguish root cause from symptom. If an option says the cause is "the reconciliation was not performed," that is really a restatement of the condition. The exam rewards options that identify the underlying reason – lack of training, unclear accountability, inadequate supervision, system design, resource constraints. When asked for the "most useful" or "most appropriate" cause, choose the deepest root cause offered.
5. Spot effect by looking for risk, exposure, or consequence. "Could result in," "exposes the organization to," "resulted in a loss of," "misstated risk reporting to the board" all indicate effect. Prefer effects that are quantified or clearly linked to organizational objectives and risk appetite. Potential effects are legitimate; the auditor need not wait for a loss to occur.
6. Know which element is missing. A common question presents a draft finding and asks what is lacking. Check the four elements systematically. Findings that state a problem and recommendation but never say why it matters are missing effect; findings that describe the problem and impact but not why it happened are missing cause; findings with no benchmark are missing criteria.
7. Recommendations should address the cause, not the condition. If a question asks for the best recommendation, eliminate options that merely say "correct the errors" or "update the register" (symptom fixes) and choose the one that fixes the root cause (e.g., "assign ownership and implement a monitoring control").
8. Watch the wording quality attributes. Options that are judgmental ("management was careless"), vague ("controls are poor"), or speculative without evidence violate Standard 2420's requirement for objective, clear, and constructive communication. Choose factual, specific, balanced wording.
9. Remember that significance drives reporting. Not every observation needs full elaboration or escalation; the effect and the organization's risk appetite determine whether an issue is reported to senior management or the board. Questions about "what should be included in the final report" often turn on significance and the needs of the audience.
10. Think from the reader's perspective. The audit committee and senior management need to understand the gap, its root cause, and its consequence quickly. If an option improves the reader's ability to make a decision about risk, it is usually the best answer.
11. Eliminate options that confuse roles. Management owns the risks and the corrective actions; internal audit identifies and communicates findings. Options suggesting the auditor should implement the fix or decide the risk appetite are wrong.
12. Practice with mini-scenarios. Before the exam, take any control weakness you know and write out the four elements plus a recommendation in two sentences each. This builds the pattern recognition the CRMA exam tests.
Summary
Criteria (what should be), condition (what is), cause (why), and effect (so what) are the backbone of a persuasive, actionable internal audit finding and are essential to communicating risk management assurance effectively. Mastering their definitions, recognizing them in scenario wording, distinguishing root causes from symptoms, and linking recommendations to causes will equip you to answer CRMA questions in this domain with confidence.
In the IIA Certification in Risk Management Assurance (CRMA) exam, the domain on Communicating Risk Management Assurance tests your ability to turn observations about risk management processes into clear, actionable findings. The IIA's International Professional Practices Framework (IPPF), specifically Standard 2410 (Criteria for Communicating) and the related implementation guidance, describes the elements of a well-constructed observation: criteria, condition, cause, and effect, usually followed by a recommendation or management action plan. Internal auditors often remember this as the "4 Cs" or the "C-C-C-E" model.
Why does it matter? A finding that merely says "controls are weak" gives management nothing to act on. A finding that states what should be (criteria), what is (condition), why the gap exists (cause), and what it means for the organization (effect) allows the board, senior management, and risk owners to understand the significance of the issue, prioritize remediation, and fix the root problem rather than the symptom. For a risk management assurance provider, this structure is the bridge between assessing the effectiveness of risk management and influencing improvement in governance, risk management, and control.
What the Four Elements Are
1. Criteria – "What should be"
Criteria are the standards, measures, expectations, or benchmarks used to evaluate the matter under review. In risk management assurance, criteria may include: the organization's risk management framework or policy, the board-approved risk appetite statement, COSO ERM or ISO 31000 principles, laws and regulations, contractual requirements, industry leading practices, key risk indicator (KRI) thresholds, and management's own documented procedures. Criteria should be agreed with management during planning wherever possible. If no suitable criteria exist, the internal auditor must work with management and/or the board to identify appropriate criteria (Standard 2210.A3).
2. Condition – "What is"
The condition is the factual evidence the auditor found during the engagement – the actual state of affairs. It must be objective, verifiable, and supported by sufficient, reliable, relevant, and useful information (Standard 2310). Example: "Risk registers for three of the five business units reviewed had not been updated in over 18 months, although policy requires quarterly updates." Conditions are stated without blame or opinion; they describe observed facts.
3. Cause – "Why the difference exists"
The cause explains the reason for the gap between the criteria and the condition. This is the most analytically demanding element because the auditor must identify the root cause, not just the surface symptom. Typical root causes include: unclear roles and responsibilities, inadequate training, insufficient resources, poorly designed processes, lack of management oversight, weak tone at the top, misaligned incentives, or system limitations. Root cause analysis techniques such as the "5 Whys," fishbone (Ishikawa) diagrams, and Pareto analysis are useful. Addressing the root cause prevents recurrence; addressing a symptom does not.
4. Effect – "So what?"
The effect is the risk or exposure the organization faces because the condition differs from the criteria. It answers the question "why should management care?" Effects may be actual (losses already incurred) or potential (exposure to loss, non-compliance, reputational damage, missed objectives, inaccurate risk reporting to the board, decisions made on stale risk information). Quantify effects where practical (financial amounts, number of transactions, percentage of population) because quantification helps management prioritize. The effect links the finding to the organization's objectives and risk appetite, which is central to risk management assurance.
Recommendation / Management Action
Although not one of the four core elements, findings are normally completed with recommendations or agreed management action plans, including a responsible owner and target date. Good recommendations address the cause, are cost-effective, and are proportionate to the effect.
How the Model Works in Practice
Think of the four elements as a logical chain:
• The gap between Criteria and Condition establishes that a finding exists.
• The Cause explains the gap and tells you where to aim the fix.
• The Effect justifies the significance and drives prioritization.
• The Recommendation closes the loop by targeting the cause.
Worked example (risk management assurance context):
Criteria: The enterprise risk management policy requires each business unit to assess emerging risks and report any risk exceeding appetite to the Risk Committee within 30 days.
Condition: Testing identified four risks rated "above appetite" in business unit registers that were not escalated to the Risk Committee; the average delay was 95 days.
Cause: Risk owners were unaware of the escalation requirement because the policy update was not communicated, and no system workflow flags above-appetite ratings.
Effect: The Risk Committee and board made resource allocation decisions without knowledge of four significant exposures, undermining the reliability of risk reporting and potentially exposing the organization to unmitigated losses estimated at up to $2 million.
Recommendation: Management should communicate the escalation requirement to all risk owners, deliver targeted training, and configure the GRC system to automatically alert the risk function when ratings exceed appetite.
Also note the related IIA guidance: communications must be accurate, objective, clear, concise, constructive, complete, and timely (Standard 2420). Positive observations and satisfactory performance should also be acknowledged where appropriate (Standard 2410.A2), and the engagement opinion or conclusion should be supported by the findings taken together.
How to Answer Exam Questions on This Topic
CRMA questions on this area are typically scenario-based. You may be given a short narrative and asked to identify which element is described, which element is missing, which statement is the best-written version of an element, or what the auditor should do next. The key skill is to classify statements correctly and to recognize weak versus strong findings.
Exam Tips: Answering Questions on Criteria, Condition, Cause, and Effect in Findings
1. Use the four signature questions. Criteria = "What should be?" Condition = "What is?" Cause = "Why did it happen?" Effect = "So what – what is the risk or impact?" Map every statement in the scenario to one of these before reading the answer options.
2. Spot criteria by looking for a standard or requirement. Words such as "policy requires," "regulation mandates," "framework states," "best practice suggests," or "the risk appetite statement limits" signal criteria. Remember that criteria should ideally be agreed with management, and if none exist, the auditor must help identify them – not simply drop the issue.
3. Spot condition by looking for observed, factual evidence. Phrases such as "testing revealed," "the auditor observed," "12 of 40 samples," or "records show" indicate condition. The condition must be supported by evidence; an unsupported assertion is not a valid condition.
4. Distinguish root cause from symptom. If an option says the cause is "the reconciliation was not performed," that is really a restatement of the condition. The exam rewards options that identify the underlying reason – lack of training, unclear accountability, inadequate supervision, system design, resource constraints. When asked for the "most useful" or "most appropriate" cause, choose the deepest root cause offered.
5. Spot effect by looking for risk, exposure, or consequence. "Could result in," "exposes the organization to," "resulted in a loss of," "misstated risk reporting to the board" all indicate effect. Prefer effects that are quantified or clearly linked to organizational objectives and risk appetite. Potential effects are legitimate; the auditor need not wait for a loss to occur.
6. Know which element is missing. A common question presents a draft finding and asks what is lacking. Check the four elements systematically. Findings that state a problem and recommendation but never say why it matters are missing effect; findings that describe the problem and impact but not why it happened are missing cause; findings with no benchmark are missing criteria.
7. Recommendations should address the cause, not the condition. If a question asks for the best recommendation, eliminate options that merely say "correct the errors" or "update the register" (symptom fixes) and choose the one that fixes the root cause (e.g., "assign ownership and implement a monitoring control").
8. Watch the wording quality attributes. Options that are judgmental ("management was careless"), vague ("controls are poor"), or speculative without evidence violate Standard 2420's requirement for objective, clear, and constructive communication. Choose factual, specific, balanced wording.
9. Remember that significance drives reporting. Not every observation needs full elaboration or escalation; the effect and the organization's risk appetite determine whether an issue is reported to senior management or the board. Questions about "what should be included in the final report" often turn on significance and the needs of the audience.
10. Think from the reader's perspective. The audit committee and senior management need to understand the gap, its root cause, and its consequence quickly. If an option improves the reader's ability to make a decision about risk, it is usually the best answer.
11. Eliminate options that confuse roles. Management owns the risks and the corrective actions; internal audit identifies and communicates findings. Options suggesting the auditor should implement the fix or decide the risk appetite are wrong.
12. Practice with mini-scenarios. Before the exam, take any control weakness you know and write out the four elements plus a recommendation in two sentences each. This builds the pattern recognition the CRMA exam tests.
Summary
Criteria (what should be), condition (what is), cause (why), and effect (so what) are the backbone of a persuasive, actionable internal audit finding and are essential to communicating risk management assurance effectively. Mastering their definitions, recognizing them in scenario wording, distinguishing root causes from symptoms, and linking recommendations to causes will equip you to answer CRMA questions in this domain with confidence.
Test mode:
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3053 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Criteria, Condition, Cause, and Effect in Findings questions
22 questions (total)
Other Communicating Risk Management Assurance concepts
Communicating Emerging Risks to Senior ManagementCommunicating Risk Management EffectivenessDeveloping the Engagement ReportEscalating Risk Acceptance to the BoardEvaluating Management Responses to Key RisksManagement Acceptance of Unacceptable RiskMonitoring and Follow-Up of Engagement ResultsObtaining Management Responses and Action PlansOverall Opinions on Risk ManagementPlanning Engagement CommunicationsReporting to the Audit Committee on RiskTailoring Risk Communications to AudiencesThe Exit Conference