The Four C's of findings consist of which elements?

• A. Condition, Criteria, Cause, Consequence
• B. Context, Criteria, Cause, Challenge
• C. Condition, Compliance, Cost, Consequence
• D. Context, Compliance, Conformance, Consequence

Answer: (A)

The main idea here is recognizing the standard four components used to describe audit findings: what is observed (the condition), the standard used to judge it (the criteria), why the gap exists (the cause), and what happens if it isn’t fixed (the consequence). Each piece anchors the finding in a measurable way: you report what’s happening, what it should be according to policy or a control objective, why the deviation occurred, and the risk or impact if it remains unaddressed.

Condition describes the actual state of the control, process, or control environment. Criteria are the specific policy, standard, or control objective you’re comparing against. Cause digs into the root reason the condition deviates from criteria, such as a misconfiguration, missing process, or inadequate training. Consequence conveys the potential or realized impact, like increased risk of data loss, regulatory noncompliance, or financial impact.

The other choices mix in terms that aren’t part of the established four components for findings. For example, Context or Challenge aren’t the accepted elements in this framework, and Cost or Conformance/Compliance don’t fit the standard four Cs of findings.