How to Present Audit Findings to Management

Audit findings presentations are adversarial by nature. Management knows you are about to tell them what their team did wrong, in front of their peers or their own supervisors. The dynamics are complicated by the audit function's independence mandate — auditors are supposed to report what they found, not what management wants to hear.

A skilled audit findings presentation navigates this tension: it maintains the integrity of the findings, delivers the message clearly, and gives management the information they need to fix the problem — without becoming either a confrontation or a whitewash.

Audience Dynamics

Process owners (operational managers whose area was audited) may be defensive, may argue with the severity rating, or may dispute the factual basis of findings. They are rarely happy to see you.

Executive management wants a clear picture of organizational risk without having to referee a technical dispute between audit and operations. They expect you to have resolved factual disputes before the meeting.

Audit committee (for internal audit presentations) is the oversight body you ultimately serve. They need to know that significant risks have been identified and that management has a credible plan to address them.

External parties (for presentations to regulators, external auditors, or accreditation bodies) have their own standards for what constitutes adequate disclosure.

Pre-Presentation: Resolve Factual Disputes First

Never present a finding in a management meeting that contains a factual error. If management disputes a fact in your finding, investigate before the presentation. Either your finding was wrong (correct it) or management's information was wrong (document that and maintain your finding).

Factual disputes that surface during a findings presentation damage the audit function's credibility, regardless of who is right. Resolve them in draft review.

Recommended Structure

Slide 1: Audit Scope and Objectives

What was audited? What period was covered? What were the audit objectives?

This slide establishes the context and limits of your findings. If management argues that you missed something important, your scope slide is your answer — and if the scope was genuinely too narrow, acknowledge it and note a follow-up engagement.

Slide 2: Executive Summary — Overall Opinion

State your overall conclusion on the area audited. Many audit functions use a rating scale (satisfactory, needs improvement, unsatisfactory, or similar). Whatever your scale, state the rating clearly and explain in one to two sentences what drove it.

If there are significant findings, the executive summary should not bury them. A management team that reads the summary and is surprised by the findings pages later has been misled.

Slide 3: Summary of Findings

A table showing all findings from the engagement:

| Finding | Risk Rating | Management Owner | Target Remediation Date | |---------|-------------|-----------------|------------------------| | | | | |

Use a consistent risk rating methodology. High/Medium/Low based on likelihood and impact is standard. Include the definition of each rating level in an appendix so there is no ambiguity.

Slides 4–N: Individual Findings

For each finding, a dedicated slide:

Finding Title: Descriptive and specific. "Segregation of duties controls over accounts payable are insufficient" — not "AP control issues."

Risk Rating: High / Medium / Low with the rationale.

Condition: What you found. Specific, fact-based, without editorial language. "In a sample of 40 disbursements, 7 (17.5%) were approved by the same individual who initiated the transaction."

Criteria: What should be happening. The policy, regulation, standard, or control objective that the condition fails to meet.

Root Cause: Why the condition exists. This is the most analytically important section. Without understanding the root cause, management cannot design an effective fix. Common root causes: inadequate staffing, system limitations, undocumented procedures, insufficient oversight, training gaps.

Avoid conflating the symptom (what went wrong) with the root cause (why the control failed). "The employee made an error" is a symptom. "There is no supervisory review of this transaction type" is a root cause.

Impact: What happened or could happen because of this condition. If there were financial losses, estimate them. If there is regulatory exposure, name the regulation and the potential penalty. If the risk is theoretical, assess the likelihood it will materialize.

Management Response: What management commits to do, by when, and who is responsible. This is written by management, not audit, and is included in the final report. Auditors may note disagreement with a management response that they consider inadequate.

Target Date: When the remediation will be complete. This is management's commitment.

Final Slide: Summary of Action Items and Follow-up

A clean table of all management commitments with owners and dates. This is the accountability record the audit function will use for follow-up testing.

Handling Management Pushback

Factual disputes: If management disputes a fact in the meeting, note it, commit to follow up, and do not change the finding on the spot. Validate their claim afterward.

Rating disputes: Management often argues that a finding should be Medium instead of High. Be prepared to explain your rating methodology specifically. If management's argument has merit (a mitigating control you missed), revise the rating. If it does not, document the disagreement.

Materiality arguments: "This only happened in 7 out of 40 samples" — acknowledge the error rate while maintaining the significance of a 17.5% error rate in a high-risk process.

"We already fixed it": If a finding has been remediated since the audit, acknowledge this in the finding and note that it will be validated in follow-up testing. A control that was broken and has now been fixed is still a finding.

Design Principles for Audit Presentations

Consistent finding format. Every finding should have the same structure. Inconsistency makes the presentation harder to read and can imply that some findings received less rigorous analysis.

Neutral language. Avoid editorial characterizations. "Management failed to implement controls" is more accusatory than "controls were not in place." Both communicate the same fact with very different tone. In an adversarial setting, neutral language reduces defensiveness.

No surprises. Management should have reviewed a draft of every finding before the formal presentation. The meeting is for questions and management response — not for first exposure to the findings.

Building Your Audit Presentation

Slide-deck.io provides clean, table-friendly layouts that work well for audit findings presentations. The simple format supports the structured, consistent finding layout that audit presentations require without distracting from the substance.

Summary

Audit findings presentations succeed when findings are fact-based, root-cause-focused, clearly rated, and accompanied by specific management commitments. Resolve factual disputes before the meeting, use neutral language, and ensure management has seen the draft before the formal presentation. The goal is understanding and remediation — not confrontation.