My first audit report was rejected

Looking back, here's everything I wish someone had told me on day one.

 
Phil Irving — CISSP, CISA. 45 years in IT security and internal audit.

🎯 Course 1 is live now — Enroll in Audit Findings That Land.

Look at my experience delivering courses.

1. Audit Findings That Land

Your first audit report was rejected? Mine was too.
Learn the 5 C's framework and the Fact Sheet process that turns findings management into ones actually argues for, not against — built from 45 years of real fieldwork, not theory. In 1 hour 53 minutes, you'll understand why most findings get filed and forgotten — and the framework that makes yours stand out.

Written and taught by Phil Irving, CISSP, CISA, with 45 years experience in IT security consulting and IT security audits.

CPE hours

Auditors holding CISA, CISM, or CISSP may be able to self-report this course as self-study CPE credit — check your certification body's current policy for how to calculate and categorize the hours. Using ISACA's 50-minutes-per-hour convention, 113 minutes is about 2 CPE hours; using ISC2's roughly 1:1 clock-hour convention, it's closer to 1.75–2 CPE hours.)

→ Enroll

What You Get

Course Description

Why Most Audit Findings Never Get Acted On

Every auditor has had this happen: weeks of rigorous fieldwork, real and significant problems uncovered, everything documented accurately — and the report still gets filed and forgotten. That's not a failure of audit work. It's a failure of communication. Decision-makers reading a finding aren't looking for technical detail; they're silently asking three questions — what is the problem, how bad is it, and what do we do about it? If a finding doesn't answer those clearly, the work behind it doesn't matter. This course was built after its instructor's own first audit report was rejected outright by his Director of Internal Audit, who told him bluntly: "This is not an audit report. This is a remediation plan. Go learn the difference." That moment became the foundation for everything taught here.

The Five Cs: A Framework for Findings That Hold Up

At the core of the course is a structured approach to writing findings — the Five Cs: Criteria, Condition, Cause, Consequence, and Correction. Think of it as a bridge with five spans, carrying management from "here's what's wrong" to "here's what to do about it." Students learn to avoid the specific mistakes that sink findings before they're even read: the orphaned standard (citing a policy the organization never adopted), the unsupported superlative (vague words standing in for real numbers), the surface cause (stopping at the first explanation instead of the root one), the throwaway Consequence line that creates no urgency, and recommendations that fix symptoms instead of causes. Each element is taught with real before-and-after examples, so students see exactly what separates a finding that gets dismissed from one that gets action.

The Fact Sheet: Solving Pushback Before It Starts

Most audit training stops at how to write the report. This course goes further, teaching the Fact Sheet process — sharing findings with management during fieldwork, before anything is finalized, so most disputes are resolved while they're still small and manageable instead of erupting in the final report meeting. Students learn how to run that conversation, and how to handle the pushback scenarios that come up again and again: "we already fixed that," "your sample wasn't representative," and "this isn't really a risk to us." This is the piece most courses never teach — and it's often the difference between a report management fights and one they actually help write.

Who This Course Is For

Whether you're newly certified and preparing your first real audit, or an experienced auditor whose findings keep getting watered down or ignored, this course gives you a practical, field-tested framework — not audit theory, but the specific writing and communication skills that get findings accepted and acted on. It's built from decades of real audit work, distilled into a format you can apply to your very next report.

Chapters

You can watch the chapters in any order.

  1. Introduction to Audit Findings That Land
  2. Summary of Five Cs Framework: quick overview that aligns with Fact Sheet process
  3. The Fact Sheet Process: introduction and benefits gained
  4. Using Fact Sheets: practical guidance
  5. Fact Sheet Meetings: conducting meetings with management to benefit both parties
  6. Five Cs - Criteria: the what should be (standards to measure against)
  7. Five Cs - Condition: the what is (observations)
  8. Five Cs - Cause: the why (drill down to root causes)
  9. Five Cs - Consequence: the so what (business impact)
  10. Five Cs - Correction: the what now (recommendations)
  11. Recap and Closing: summary of Five Cs and Fact Sheet process
  12. Resources to download - see What You Get above

→ Enroll

2. Audit Reports Reference Guide (Kindle)

This guide includes a real before-and-after case study showing the exact difference the tools make. Most audit reports get filed and forgotten — not because the findings were wrong, but because the report did not obtain management's buy-in when it was submitted. This guide covers two tools that change that, plus the complete structure of an effective audit report.

This guide is based on the first two courses that explore this material in greater depth. It is built for auditors, audit managers, and anyone responsible for turning audit evidence into action that actually gets taken.

Available on Kindle, $9.99

3. The Accepted Audit Report

Your finding is solid — so why did the report still get pushback?
Go from individual findings to a complete, submission-ready audit report — the nine-component structure, the executive summary that actually gets read, and the scorecard approach that turns your report from a list of problems into a tool management wants to engage.

Coming soon

4. Running Audits: from Planning to Closing

Before you can write a finding, you have to know what you're testing — and why.
Build the System Description and Risk Summary that make every finding that follows faster, sharper, and harder to dispute. This is where good audits actually begin.

Coming soon