Findings that begin with “management should enhance the control environment” stall. Findings that name the break, the period, the evidence, and a suggested owner move.
We prefer: what we saw, why it matters for customers or licence conditions, how severe it looks relative to peer issues in the same engagement, and what a first remediation step could be. Severity is a judgement call — we explain ours.
Mild reservations belong in findings too. If sampling was limited by missing logs, say so. Overstating certainty helps nobody when the committee later discovers the gap.
Keep customer identifiers out of shared decks. Patterns travel; names do not need to.