BAMML Executive Insights
Most Audit Findings Are Not Findings About Money
There is a particular kind of meeting that happens in public entities after an audit. The findings are read out, and somewhere in the room the mood settles into defensiveness, because everybody hears the findings as accusations.
Most of the time they are not.
In our experience, the majority of findings are not saying that a transaction was improper. They are saying something narrower and more awkward: that the entity could not demonstrate the transaction was proper.
Those are very different statements, and the distinction determines what you should do next.
What is actually happening
An auditor tests a transaction by asking for the evidence that it followed the rules. Approval at the right level. A compliant procurement process. A contract. Proof that goods or services were actually received. Correct recording.
If that evidence is complete and available, the transaction passes. If any part of it cannot be produced, the transaction is flagged — regardless of whether it was, in fact, entirely legitimate.
This is why entities so often feel wronged by their audit outcome. Officials know the expenditure was genuine. The service was delivered. The price was reasonable. And the finding still stands, because the finding is not about their belief. It is about the file.
The evidence was probably created at the time. Somebody signed something. A quote was obtained. A delivery was received and checked. But it was created as a step in getting the work done, not as a record built to be tested eighteen months later by someone with no knowledge of the circumstances.
So it sits in an inbox, or a desk drawer, or with an official who has since left.
Why it matters
Misreading the nature of a finding produces the wrong response, and the wrong response is expensive.
If findings are heard as accusations, the response becomes defensive — explanations, disputes, investigations into individuals. That consumes enormous management time and rarely changes next year's outcome, because next year's audit will test a fresh sample against the same evidence practice.
If findings are read accurately — as a failure to evidence — the response is administrative and largely mechanical. Decide what evidence each transaction type requires. Decide who attaches it, and when. Build the file as the transaction happens rather than reconstructing it under audit pressure.
That work is unglamorous. It is also the work that changes the outcome.
There is a second consequence. When everything is heard as an accusation, the genuinely serious findings — the ones that really are about money — get the same volume of defensive noise as the documentary ones. They become harder to see, not easier.
The Integrated View
| Discipline | What it contributes | Consequence when absent |
|---|---|---|
| Risk & Compliance | A defined evidence standard per transaction type | Every official decides for themselves what to keep |
| Financial Governance | Evidence attached at the point of transaction, not at year-end | Reconstruction under pressure, months later |
| Operational Performance | The evidence step built into the process itself | An additional task nobody has time for |
| Workforce Governance | Named responsibility, and capability to do it | Assumed to be somebody's job |
| Executive Decision Intelligence | Visibility of file completeness before the auditors arrive | The first time you find out is when they tell you |
What changed for one entity
One BAMML client, a public entity, had a history of qualified audits. Annual financial statements were being assembled without a structured evidence trail behind them, which left transactions unsupported the moment they were tested.
BAMML was engaged ahead of the annual audit to prepare the AFS and build the full supporting audit file — sourcing and attaching evidence for every transaction, rather than reconstructing it once the auditors had asked.
That year, the entity achieved a clean audit opinion.
Nothing about the entity's spending changed. What changed was whether it could be proved.
What to do on Monday
- Take last year's findings and sort them into two piles: those saying a transaction was improper, and those saying it could not be evidenced. The relative size of the two piles is your real diagnosis.
- For the second pile, identify which evidence was missing — approval, procurement record, contract, proof of receipt. There will be a pattern, usually a short one.
- Define the evidence standard for each transaction type, in writing, and make it specific enough that a new official could follow it.
- Name who attaches the evidence, and at what moment. If the answer is "at year-end", you will be here again.
- Test a sample yourself, mid-year. Pull ten transactions at random and ask for the file. What you find in March is what the auditors will find in September.
That last step is the whole discipline in miniature. Audit readiness is not something you prepare for. It is something you either maintain or you do not.
