Methodology

Financial auditing that centres on control deficiency logging only works when every finding is comparable. Below is the method we apply on engagements in Hong Kong so registers stay consistent from kick-off to close.

1. Cycle selection

We start with the financial reporting risks that matter for your entity type: trading cut-off, inventory existence, cash completeness, payroll accuracy, and journal review are common. You choose which cycles enter the register this season; we advise where prior auditor comments suggest priority.

2. Evidence before opinion

No deficiency is logged from hallway conversation alone. We require a walkthrough, a document sample, or system extract that shows the control as operated. If evidence cannot be produced, we may log a design gap — but we label it clearly as such.

3. Four-part finding structure

Every register line records:

• Condition — what we observed
• Criteria — the policy, standard, or expectation it fails
• Cause — why the break occurs (capacity, design, override, training)
• Effect — plausible impact on the financial statements or fraud risk

4. Severity without theatre

We rate findings as significant deficiency or lesser weakness using the practical lens your external auditors are likely to apply. We avoid inflated language; a missing secondary review on immaterial petty cash is not treated like an unreconciled suspense account at month-end.

5. Owners and dates

A logged deficiency without an owner ages badly. During the wrap-up meeting we assign a named person inside your organisation and a realistic target date tied to the next close, not an arbitrary “ASAP.”

6. Handover

You leave with an editable register, a one-page status summary for leadership, and optional support for a later remediation follow-up review.