Para 17.7 — CAM

(a) Criteria: What should exist? The benchmarks or expectations identified as the basis against which audit evidence is compared. (E.g. Policy, SOP, Norm, etc.)

(b) Condition: What exists? The factual evidence found in the course of the audit. The condition identifies the nature and the extent of the observation. A clear and accurate statement of condition evolves from the auditor’s comparison of actual evidence with appropriate criteria.

(c) Consequence/Effect/ Impact: What effect did it have? The risk or exposure to the institution and/or others as a result of the difference between the criteria and the condition should be recorded. The effect establishes the actual or potential impact of the condition. The significance of a condition is usually judged by its effect. It can be expressed in quantitative terms. To warrant reporting, an effect should be sufficiently serious to justify the action (and related cost) to correct the difference (the deficiency).

(d) Cause: Why did it happen? The possible or likely reason for the difference between the expected and actual condition should be explored. The cause may be obvious or may be identified by deductive reasoning. The identification of similar causes for a number of observations may highlight an underlying risk and the audit recommendation should address it. Identification of the cause of an unsatisfactory condition is a prerequisite to making a meaningful recommendation for corrective action.

(e) Corrective Action/ Recommendation: What should be done? The actions suggested or required to correct the situation and prevent future occurrences. The relationship between the audit recommendation and the underlying cause of the condition should be clear and logical. In developing sound recommendations, the IA ensures that the recommended action is within the scope of the auditee, addresses the cause and not just the symptoms, and is viable.