The 4C Model: From Audit Finding to Better Decision
An audit finding should not simply announce that something is wrong.
It should help people see the problem clearly, understand why it exists and decide what must change.
This is where the Condition–Criteria–Cause–Effect model, commonly known as the 4C model, becomes valuable.
At Phronesium, we see the 4C model as more than a reporting template. It is a framework for disciplined thinking. It connects evidence with judgement—and judgement with action.
The 4C Model: From Evidence to Action
The image shows the 4C model as a journey from evidence to better decisions:
Condition: What is happening?
Criteria: What should be happening?
Cause: Why does the gap exist?
Consequence (Effect): Why does it matter?
Together, these four elements turn an audit observation into a clear and logical finding. The message is simple: good audit writing does not merely identify a problem—it explains it and supports intelligent action.
An audit is only as useful as its message
Auditors may perform excellent work, collect strong evidence and identify important weaknesses. But if the finding is poorly written, much of that value disappears.
Management may misunderstand the issue. The risk may receive the wrong priority. An action may repair the visible failure while leaving its real cause untouched.
A strong audit finding answers four simple questions:
What is happening?
What should be happening?
Why is there a gap?
Why does it matter?
These are the four elements of the model:
Condition. Criteria. Cause. Effect.
Simple questions—but not always simple answers.
Condition: What did we find?
The condition describes what is happening in practice. It should be factual, precise and supported by evidence.
Weak:
Access reviews are not performed properly.
Stronger:
In 8 of the 20 accounts sampled, evidence of the required quarterly access review could not be provided. Three accounts belonged to former employees and remained active more than 60 days after their departure.
The first version expresses concern. The second provides information.
A good condition explains what was tested, what was found and how significant or widespread the exception was.
The discipline is simple: Write what the evidence proves—no more and no less.
Criteria: What should be happening?
The criteria establish the expectation against which the condition is assessed.
They may come from:
laws and regulations;
internal policies and procedures;
contractual obligations;
professional standards;
approved control frameworks;
recognised good practice.
Weak:
Access should be reviewed regularly.
Stronger:
The Access Management Policy requires system owners to review privileged access quarterly and remove access promptly when it is no longer required.
Criteria separate professional judgement from personal preference.
The auditor is not saying:
This is how I would do it.
The auditor is saying:
This is the agreed or required standard, and the evidence shows a gap.
Without clear criteria, a finding may become an opinion wearing the clothes of assurance.
Cause: Why did it happen?
The cause explains why the condition exists.
This is often the most difficult part of the finding—and frequently the most valuable.
Weak:
Staff did not follow the procedure.
Stronger:
Responsibility for initiating and documenting the quarterly review was not formally assigned. The system also did not issue reminders or escalate overdue reviews.
“Human error” is rarely the end of the analysis. It is often the beginning.
The auditor should ask:
Why was the error possible?
Why was it not detected?
Why did the problem continue?
Was ownership clear?
Was the control realistically designed?
Did systems, resources or incentives contribute?
If we misunderstand the cause, we are likely to agree the wrong action.
More training will not solve unclear ownership. A new procedure will not correct insufficient resources. Another reminder will not repair a badly designed process.
Good auditors do not stop at the symptom.
Effect: Why does it matter?
The effect answers the question every busy executive is silently asking:
So what?
It explains the actual or potential consequence of the condition, such as:
financial loss;
regulatory breach;
operational disruption;
inaccurate reporting;
fraud or misconduct;
customer harm;
reputational damage;
failure to achieve an objective.
Weak:
This creates a security risk.
Stronger:
Unnecessary privileged access may remain active, increasing the risk of unauthorised system changes, data loss or disruption to critical operations.
The effect should be specific, credible and proportionate.
Not every weakness leads to catastrophe. If every finding predicts regulatory action, reputational collapse and financial disaster, the language soon loses its force.
A good auditor does not dramatise the risk. A good auditor makes it visible.
The complete 4C finding
When the four elements are brought together, the reasoning becomes clear:
Condition: In 8 of the 20 accounts sampled, evidence of the required quarterly access review could not be provided. Three accounts belonging to former employees remained active more than 60 days after their departure.
Criteria: The Access Management Policy requires system owners to review privileged access quarterly and remove access promptly when it is no longer needed.
Cause: Responsibility for initiating and documenting the review was not formally assigned. The system did not generate reminders or escalate overdue reviews.
Effect: Unnecessary privileged access may remain active, increasing the risk of unauthorised changes, data loss and disruption to critical operations.
The reader can follow the logic:
What is happening → what should happen → why the gap exists → why the gap matters.
That is not merely good writing. It is good reasoning.
The 4C model begins before the report
The 4C model should not be introduced only when fieldwork is complete and somebody opens the report template.
It should guide the audit itself.
During fieldwork, it encourages auditors to ask:
Do we have enough evidence to prove the condition?
What authoritative criteria apply?
Have we identified the real cause?
Can we explain a credible effect?
A missing element may reveal unfinished audit work.
If there is no clear criterion, the issue may be a preference rather than a genuine weakness. If the effect cannot be explained, its significance may be uncertain. If the cause remains unknown, the proposed action may not produce lasting improvement.
The quality of the report therefore depends on the quality of the thinking that comes before it.
From information to judgement
The 4C model reflects the wider philosophy of Phronesium.
Evidence alone is not enough. It must be organised.
Rules alone are not enough. They must be understood.
Problems alone are not enough. Their causes must be examined.
Risks alone are not enough. Their meaning must be communicated.
This is where phronesis—practical wisdom—enters the audit process. It is the ability to apply knowledge and experience to a real situation and reach a sound, proportionate judgement.
The 4C model gives that judgement a visible structure.
ElementAudit questionPurposeConditionWhat is happening?Establish the factsCriteriaWhat should be happening?Define the expectationCauseWhy is there a gap?Identify what must changeEffectWhy does it matter?Explain the risk and priority
Common weaknesses in audit findings
A finding may include all four headings and still fail to communicate.
Common problems include:
too much description and too little meaning;
criteria that are assumed rather than stated;
symptoms presented as root causes;
generic or exaggerated risks;
recommendations disconnected from the cause;
technical language that obscures a simple point.
The purpose of the 4C model is not to make findings longer. It is to make them clearer.
Every sentence should earn its place.
The Phronesium test
Before finalising a finding, ask:
Truth: Can every factual statement be supported by evidence?
Clarity: Can a busy reader understand the issue at first reading?
Logic: Is the connection between condition, criteria, cause and effect convincing?
Proportionality: Does the language reflect the real significance of the issue?
Action: Will the proposed response address the cause rather than only the symptom?
If the answer to one of these questions is no, the finding may not yet be ready.
The Phronesium Test: five questions to ask before finalising an audit finding.
It guides the auditor through truth, clarity, logic, proportionality and action. A finding is ready to report only when it is supported by evidence, easy to understand, logically constructed, proportionate to the risk and able to address the real cause—not merely the visible symptom.
From finding to action
A weak finding says:
Something is wrong.
A better finding says:
This is what is happening. This is what should be happening. This is why the gap exists. This is why it matters.
The first creates noise.
The second creates understanding.
At Phronesium, we believe that the purpose of audit writing is not to sound important. It is to make the important visible.
Condition establishes the truth.
Criteria establish the standard.
Cause identifies what must change.
Effect explains why change matters.
When all four are clear, an audit finding becomes more than a paragraph in a report.
It becomes an argument for intelligent action—and a foundation for better decisions.
