How to read a state audit finding without overstating fraud

By ImpactLine · Sources reviewed October 8, 2026

An audit finding can establish a serious problem without establishing fraud. Read what the auditors examined, what evidence they obtained and what they concluded. Then follow the recommendation to the agency’s response and the next report.

Start with the audit’s question

Before reading the headline finding, locate the objectives, scope and methodology. Which program and period were examined? Was the audit about financial statements, compliance, program performance or a specific control? Which records were available? What testing or sampling did the auditors describe? The scope tells you what the conclusion can support.

An audit of one grant’s documentation does not automatically assess every payment made by an agency. A review of how purchases were approved does not necessarily measure whether a service achieved its intended outcome. Keep the report’s question next to its answer. This simple habit makes summaries more accurate and helps you locate a different report when your question falls outside the scope.

GAO’s 2024 Government Auditing Standards provide a framework for government audits, with effective dates identified on the source page. An older report may use an earlier edition. Read the standards statement in that report rather than retroactively judging it by a publication date it predates.

Break a finding into four parts

The Yellow Book’s discussion of findings distinguishes criteria, condition, cause and effect or potential effect. Criteria describe the expectation or requirement. Condition describes what auditors found. Cause explains the difference where the evidence establishes it. Effect describes the consequence or possible consequence. The elements developed depend on the audit objectives.

Build your notes around those parts. If the rule requires supervisory review and the tested records lack evidence of review, record those two facts separately. If the auditors identify understaffing as a cause, cite the supporting analysis. If the report leaves the cause unresolved, do the same. An empty worksheet cell is a useful boundary, rather than an invitation to supply a motive.

Consider a fictional purchasing review. Auditors find that selected payment files lack required approvals. The established condition is missing approval evidence in the records tested. The possible effect is that an unauthorized payment could pass through the process. Those findings justify corrective action and further inquiry. They do not, by themselves, prove that every invoice was fraudulent or that the whole purchasing budget was lost.

Read the amount’s denominator

When an audit mentions money, identify exactly what that amount measures. Is it the value of transactions reviewed, a questioned amount, a statistically estimated error, a confirmed loss or a potential exposure? Record the units and the population. Keep a sample result separate from a program-wide estimate unless the report explicitly supports extrapolation.

Suppose, in another hypothetical example, three of ten selected files are incomplete. You can say that three selected files were incomplete. You cannot infer that 30 percent of all spending was stolen. Even a well-supported error estimate needs its own definition, estimation method and uncertainty. A dollar amount becomes more meaningful when the reader can see how it was constructed.

Use the report’s exact level of certainty

GAO explains that improper payments and fraud are related but different: an improper payment does not necessarily involve intentional deception. Its improper payment estimation process is not designed to measure fraud. GAO also distinguishes fraud indicators from proof, identifying the need for further review, investigation and adjudication.

Use wording that fits the evidence: “auditors identified a control weakness,” “the report questioned these costs,” or “the agency referred the matter for investigation.” Attribute an allegation to its source and identify its status. If a subsequent investigation reaches a finding, link that record and date. Avoid upgrading a possibility into a settled conclusion as the story moves between headlines.

Follow the response through to verification

Read the agency response in full. Note which findings it accepts or disputes, what actions it promises and which deadlines it gives. A response is evidence of the agency’s position; it is not independent confirmation that the problem has been fixed. A new policy, completed training or restored control should be connected to a dated implementation record.

Then look for follow-up testing. Does the auditor mark the recommendation implemented, partially implemented or open? Does a later report identify a repeat finding? If no follow-up is available, report that limit plainly. Your question can be specific: “What record confirms supervisory review was operating during the next quarter?”

Keep a finding worksheet

1. Save the report URL, date, finding number and page.
2. Record its objective, period, sample and evidence limits.
3. Separate the criteria, condition, established cause and effect.
4. Label each amount by what it measures.
5. Copy the recommendation and summarize the agency response.
6. Attach later implementation or follow-up evidence without erasing the original finding.

Download the audit finding worksheet. Pair it with our public project delivery worksheet when the question concerns a funded service or construction project. The useful outcome is a claim someone else can check, together with a clear next question.