Writing Findings and Rating Issues (Severity × Likelihood)

A well-written finding has a standard anatomy, and the exam expects you to know it. The condition is what is, the problem you actually observed. The criteria is what should be, the regulation, policy, or standard the condition falls short of.

The cause is why it happened, the root cause we just covered. The effect is the impact, what could go wrong because of the gap, and it's paired with a recommendation for fixing it. Together these are sometimes called the elements of a finding: condition, criteria, cause, effect.

A finding missing its criteria is just an opinion; a finding missing its effect can't be prioritized. The full anatomy is what makes a finding credible and actionable.

Every finding gets a risk rating, and the ACAMS program is explicit that auditors determine the risk level of findings, typically low, medium, or high. The rating combines two dimensions: the severity of the impact if the issue is realized, and the likelihood that it occurs. A control gap that's almost certain to be exploited and would cause major regulatory and financial harm rates high; a minor documentation lapse that's unlikely to cause real damage rates low.

The rating drives priority and remediation urgency, so it has real consequences. Rate the risk on its merits, the facts and the impact, not on how loudly the auditee pushes back. Inflating or deflating a rating to manage relationships corrupts the whole purpose.

The program also asks you to distinguish material from immaterial findings. A material finding is one significant enough to meaningfully affect the AML program or a reasonable assessment of it, the kind a regulator or the board needs to know. An immaterial finding is minor, with limited consequence.

But here's the nuance the exam tests: aggregation. Several small findings that individually look immaterial can together reveal a material, systemic weakness, ten files each missing one element might signal a broken onboarding process. So you evaluate findings both individually and in aggregate.

And never bury a material issue in a long list of trivia where it gets lost; materiality should drive what surfaces to senior leaders.

How you write the finding determines whether it gets fixed. Keep it objective and fact-based, every assertion supported by the evidence in your workpapers, because a finding that overreaches its evidence gets dismissed. Be specific: name the gap precisely rather than gesturing at a vague concern.

Recommend what needs to change, the outcome required, while generally leaving the detailed how to management, who own the operations and the remediation plan. And frame the finding around risk and impact, not blame, because the goal is a stronger program, not a culprit. A finding that's specific, evidenced, risk-rated, and constructively phrased is one management can act on; a vague, accusatory one just starts an argument.

Ratings only work if they're consistent, so the audit function needs a defined rating scale applied the same way by every auditor, with clear criteria for what makes an issue low, medium, or high. Calibration matters: two auditors looking at the same facts should land on the same rating, which is why mature functions hold rating discussions and document the thresholds. Consistency also drives prioritization.

Remediation effort should be sequenced by risk, the high-risk findings fixed first, rather than by which business unit complains loudest or which fix is easiest. And individual ratings roll up into an overall opinion on the area audited, so the board can see at a glance whether the transaction-monitoring program, say, is satisfactory, needs improvement, or is unsatisfactory. That overall conclusion has to be supported by the underlying findings; a clean overall opinion sitting on top of several high-risk findings is internally inconsistent, and the exam may hand you exactly that mismatch and ask what's wrong.

Consistent, calibrated ratings are what make the whole reporting system trustworthy.

Recapping: a finding has a clear anatomy, condition, criteria, cause, effect, and recommendation, and each finding gets a risk rating that combines severity and likelihood into low, medium, or high. Judge materiality both individually and in aggregate, since small findings can sum to a systemic problem, and write findings that are objective, evidenced, specific, and risk-framed so they drive action. Next, we take these findings up the chain: reporting to management and the board or audit committee, including how to handle the management response.

Test yourself on findings and ratings first.