Finding
What is Finding?
A conclusion drawn from audit evidence that identifies a condition, criteria, cause, and effect. Audit findings range from major nonconformities to minor observations and recommendations for improvement.
Terms that appear alongside finding
Each of these is named in at least one of the same controls as finding. The number is how many controls name both.
- remediation 9 shared controls
- corrective action 4 shared controls
- gdpr 3 shared controls
- compliance 3 shared controls
- audit 3 shared controls
- observation 2 shared controls
- transparency 2 shared controls
- data protection 2 shared controls
Frameworks that govern finding
What the standards actually require on finding
Requirements naming finding across 6 standards, quoted from the control text.
Findings are reached by weighing the audit evidence against the criteria, and they may show either conformity or nonconformity. Where the audit plan calls for it, individual findings should cover conformity and good practice together with the evidence for them...
iso-19011-2026::6.4.8 · Generating the audit findings →Guidance: the evidence gathered should be assessed against the criteria so that findings can be reached, which can indicate conformity or nonconformity and, when the plan specifies, conformity and good practice with supporting evidence, improvement opportuniti...
iso-19011-2018::6.4.8 · Generating audit findings →ISO 19011:2018, 6.4.8 is followed with nothing added: evidence is evaluated against the criteria to determine findings of conformity or nonconformity (and, where the plan specifies, good practice, improvement opportunities and recommendations), nonconformities...
iso-iec-27007-2020::6.4.8 · Generating audit findings →Expenditure on an activity conducted outside Australia counts only if a Board finding under s 28C(1)(a) is in force for it (ITAA 1997 s 355-210(1)(d) and (e));
australia-r-d-tax-incentive-income-tax-assessment-act-1997-division-355::IRD-28C-28D · IRD Act ss 28C and 28D Obtain an overseas finding before counting expenditure on R&D conducted outside Australia →The policies on reviewing and updating the AML/CTF policies must cover responding to an independent evaluation report that contains adverse findings about those policies.
aml-ctf-rules-2025-australia::R5-4 · Update AML/CTF policies after an adverse independent evaluation finding →Aggregate security telemetry into standardised destinations such as S3 log archive buckets, Security Hub and a centralised SIEM so analysts and automation can correlate across sources.
SEC04-BP02 · Capture logs, findings, and metrics in standardized locations →Questions people ask about finding
What is Finding?
Why is Finding important for compliance?
Which compliance frameworks address Finding?
Where can I learn more about Finding?
See how Finding applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.