Writing a findings letter that boards actually read

After fieldwork, the temptation is to dump every observation into a single severity. Boards then either panic or skim. In audits for fintech, we use three ranks: stop-the-line, calendar-bound, and housekeeping. Stop-the-line items block a regulatory conversation or bank renewal until addressed. Calendar-bound items need owners and dates. Housekeeping items improve hygiene but should not crowd the first page.

Each finding names the control as written, the evidence tested, the break observed, and the suggested owner. We avoid vague verbs. “Strengthen monitoring” becomes “assign daily exception clearance to operations lead X and retain the clearance log for ninety days.”

Annexes hold the sample lists and interview themes. The letter itself stays short enough to be discussed in a forty-minute board slot. When management disagrees with a ranking — and they sometimes should — we record the dissent in a short note rather than rewriting history. Mild disagreement is healthy; silent acceptance of every finding is not.

If you are commissioning an audit, ask to see a redacted sample letter before you sign. The shape of the deliverable tells you whether you will receive a usable management tool or a document that only satisfies the vendor’s template.