An auditor should present exceptions identified during testing to the auditee after.

An auditor should present exceptions to the auditee only after a thorough analysis of their likelihood and impact. A preliminary observation may be incorrect or incomplete. After identifying a potential exception and performing additional testing to confirm it, the auditor must assess its significance (i.e., the risk it represents). This analysis provides the necessary context for a meaningful discussion with management about the root cause, potential consequences, and the urgency of remediation. Presenting findings without this context is premature and unprofessional.

A. Presenting preliminary observations is premature, as they have not yet been validated or assessed for significance, leading to potential inaccuracies.
B. Waiting until after the final report is issued denies the auditee the opportunity to validate findings and provide a management response.
C. While additional testing is necessary to confirm an exception, presenting it immediately after, without risk analysis, lacks crucial context for management.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing. Standard 2410: Communicating Results, states that communications must include the auditors' conclusions, as well as applicable recommendations and/or action plans. This implies analysis has occurred.

2. ACAMS. (2022). Advanced CAMS-Audit Certification Study Guide. Chapter 4: "The Audit Process: Execution and Reporting," Section on Communicating Results, outlines the process of validating findings, holding exit meetings, and discussing the significance of issues with management before finalizing the report.