Which term describes the identification of weaknesses or reasons why controls may not be working?

Which term describes the identification of weaknesses or reasons why controls may not be working?

• A. Risk assessment
• B. Control testing
• C. Audit findings
• D. Compliance review

Answer: (C)

When assessing why controls aren’t working, the result you identify is an audit finding. An audit finding is the documented observation that a control is not operating as intended, that there are gaps or deficiencies, and it often includes evidence and a recommended remedy. This makes it the natural label for the outcome of an independent evaluation that explains why a control may fail and what needs to be fixed. Risk assessment is about evaluating potential events and their impact, not detailing specific control weaknesses. Control testing is the activity of checking whether controls are designed and operating effectively, and while it can uncover issues, the formal output of that process is the finding from the audit or review. A compliance review focuses on whether activities comply with rules and requirements, not specifically on why controls fail in practice.

When assessing why controls aren’t working, the result you identify is an audit finding. An audit finding is the documented observation that a control is not operating as intended, that there are gaps or deficiencies, and it often includes evidence and a recommended remedy. This makes it the natural label for the outcome of an independent evaluation that explains why a control may fail and what needs to be fixed.

Risk assessment is about evaluating potential events and their impact, not detailing specific control weaknesses. Control testing is the activity of checking whether controls are designed and operating effectively, and while it can uncover issues, the formal output of that process is the finding from the audit or review. A compliance review focuses on whether activities comply with rules and requirements, not specifically on why controls fail in practice.