CEA Study Guide: Findings, Evidence, and Audit Judgment

READINESS CHECKS — before you consider yourself prepared, confirm you can do each of these without notes: • Given a scenario paragraph, identify the governing criteria set (permit, regulation, internal procedure, or reference standard) in under a minute. • Separate every conclusion you write into 'observed evidence' and 'auditor inference,' with a source for each piece of evidence. • State the purpose of the audit in question (compliance, system, or due diligence) and explain how it changes your checklist and finding format. • Classify a finding as major, minor, or observation and defend the classification with a stated rule, not intuition. • Write a complete four-part finding (criterion, evidence, cause, consequence) in three to five sentences. If you miss two or more, loop back to the matching section and redo the drill rather than collecting more practice questions.

What Audit Criteria Actually Are — and Why Findings Collapse Without Them

Audit criteria are the benchmarks against which evidence is compared: permits, regulations, corporate procedures, or agreed reference standards. A conclusion without a stated criterion is only an opinion, so always identify the requirement first.

Standard audit vocabulary distinguishes three layers. Criteria are the requirements you audit against; evidence is the verified information you collect; findings are the comparison of the two. Criteria can come from more than one source in the same engagement — a discharge permit, an environmental regulation, an internal operating procedure, or a management standard the organization has committed to. A sound audit plan states which criteria apply before fieldwork begins, because the criteria set determines what you look for, what you sample, and what counts as conforming behavior.

Apply this by treating every scenario question as a two-column problem: the left column is the requirement, the right column is the observed situation. A storage practice might satisfy an internal policy yet breach a permit condition, or the reverse. When practice items present both, the first decision is which criteria set the question's audit purpose invokes. Candidates who skip that decision mix requirements from different sources and produce findings that sound reasonable but answer the wrong question.

Objective Evidence vs. Auditor Inference: Drawing the Line That Reviewers Check

Objective evidence is what you directly observed, measured, or verified in records, with a traceable source. Inference is your interpretation of it. Record evidence verbatim with its source; label every conclusion separately.

Evidence earns the label 'objective' through traceability: a dated inspection record, a calibration log, a photograph of a labeled container, or an interview statement corroborated by a document. Inference is the causal or risk meaning you attach — 'this suggests the tank may be leaking.' Both are legitimate auditor outputs, but they must be distinguishable on the page. When an auditee, regulator, or reviewer can audit your reasoning from evidence to conclusion, your work is defensible; when inference is written as fact, the whole finding becomes contestable.

Take a scenario where you observe a drum marked 'used oil' stored uncovered in the rain near a storm drain. The evidence: the label, the lack of cover, the drain's proximity — each with a date and location. The inference: a potential pathway for contaminated runoff. The better written observation separates the two sentences explicitly rather than writing 'the site illegally discharges oil.' Practice items reward the same discipline: quote what was seen, then state what it potentially indicates, and never let the second sentence absorb the first.

Choosing the Right Audit Frame: Compliance, System, or Due Diligence

Compliance audits test conformance with legal requirements; management-system audits test whether the system prevents nonconformance; due diligence reviews assess environmental risk before a transaction. Match your questions, sampling, and finding format to the stated purpose.

These three frames differ in their central question and in what a 'finding' looks like. A compliance audit ends in determinations of conformance with permits and regulations. A management-system audit asks whether planning, training, corrective action, and management review would catch problems before they occur — a procedure on paper but never implemented is a system finding even if the site currently complies. Due diligence, typically triggered by property transfer or lending, focuses on identifying recognized environmental conditions and liabilities, not on issuing compliance verdicts.

In scenario questions, the audit purpose is stated in the prompt, and it should change your behavior. A due diligence engagement with no observed violations is not automatically a clean site: historical records, staining, or an abandoned structure may warrant a noted concern even without a regulatory breach. Conversely, a system audit of a fully compliant site can still produce major findings if corrective-action processes are broken. Decide the frame first, then generate findings in the format that frame expects.

Classifying Findings: Major, Minor, and Observations Without Guessing

Classification should follow a stated rule, not a gut feeling: how well-established the evidence is, how significant the gap is against the criteria, and whether the failure is isolated or systemic. Define your rule before classifying anything.

A workable convention separates three levels. A major nonconformity signals a breakdown of a required element — a total absence of a mandated record, or a condition with direct legal or environmental consequence. A minor nonconformity is an isolated lapse in an otherwise functioning requirement: one missed log entry among complete records. An observation flags an improvement opportunity or an area needing more evidence, without asserting a breach. Exact definitions vary between audit programs, so adopt one convention deliberately and apply it uniformly across your practice.

The classification skill that matters for scenarios is defending the boundary. Practice by writing your rule, then classifying a batch of vignettes: a single missed calibration entry, a repeated pattern of missed entries, a missing permit for an operating unit, a procedure that exists but is outdated. For each, write one sentence explaining the class chosen. The value of the drill is consistency — if you would call ten missed entries 'major' today, you must be able to say why, or your classifications will drift between practice items.

Writing a Defensible Finding: Criterion, Evidence, Cause, Consequence

A defensible finding states the requirement at issue, the verified evidence, the likely cause, and the consequence. Drop any element and the auditee can contest the conclusion; include all four and the corrective action nearly writes itself.

Worked scenario 1. A scenario describes a monthly wastewater report showing a recorded pH of 5.2 against a permit limit of 6.0–9.0, with the meter calibrated two months prior. The plausible mistake is writing: 'The facility ignores its permit.' That statement contains no criterion, no evidence, and an unsupported accusation of willfulness — it is both inaccurate and unusable. The better decision is a four-part finding: criterion — permit condition X limits discharge pH to 6.0–9.0; evidence — the March report records 5.2, and calibration is overdue per the meter log; cause — the calibration schedule is not tracked, so drift went undetected; consequence — nonconformance with the permit and risk of an uncontrolled discharge.

Why it matters: the improved version is verifiable (the reviewer can check the report and the log), it is classified fairly (an overdue calibration schedule is a system gap, not proof of intent), and it points to a specific corrective action — institute calibration tracking and reverify. Practice the same structure on every scenario answer you write. If your finding cannot name its criterion in the first sentence, or its evidence in the second, it is not finished.

• Rewrite drill: take three findings from your own past reports or from any practice item and rebuild each into criterion–evidence–cause–consequence.
• Self-check rubric: score each rewritten finding one point per element present (four points for criterion, evidence, cause, consequence), one point for a traceable evidence source, and one point for a fair classification — six points maximum. Five of six suggests the structure is holding; anything lower tells you which element to drill.

When Is Evidence Enough? Sampling, Audit Trails, and Thin Conclusions

Auditors sample because inspecting everything is impossible. Sufficiency depends on the risk level, the sample size relative to the population, and traceability. Flag any scenario conclusion that rests on a sample too thin for its risk.

Sampling logic in auditing mirrors its logic anywhere: higher-risk populations need deeper samples, and conclusions must be worded to reflect the coverage achieved. A second discipline is the audit trail — every record you rely on should be identifiable (document number, date, location) so a reviewer could retrieve it. The strongest scenario technique is cross-checking between paper and floor: an inspection record claims monthly tank checks, so the audit verifies whether the floor schedule, the signatures, and the records agree. Disagreement between record and observation is itself high-value evidence.

Worked scenario 2. A due diligence scenario offers three waste manifests from a site that reports roughly forty shipments a year, and the plausible mistake is concluding 'no waste management violations identified' from that sample. The better decision is to report what was verified — the three manifests checked showed complete, consistent documentation — and to state explicitly that the sample was limited, recommending an extended record review before closing the scope. Why it matters: the first phrasing implies a clean bill of health the evidence cannot support; the second protects the client's decisions and your own credibility, and it demonstrates the sufficiency reasoning this kind of exercise is designed to train.

• Adaptable preparation sequence: week one, master the vocabulary — criteria, evidence, findings, nonconformity, observation — and restate each definition in your own words.
• Weeks two to three, run classification drills on twenty short vignettes with written one-sentence rationales.
• Weeks three to four, write full four-part findings from multi-paragraph scenarios, timing yourself.
• Final stretch, mix audit types randomly (compliance, system, due diligence) so identifying the governing frame becomes automatic.

Ethics, Independence, and Scope Boundaries in Auditor Decisions

Auditor judgment must stay independent of the function audited and within the engagement's scope. In scenarios, never accept direction to soften a finding, and never drift into consulting or personally handling hazards you identified.

Independence has a concrete test: if you helped design, operate, or approve the system you are examining, you generally cannot audit it objectively. A useful exercise is to scan each practice scenario for role conflicts — an auditor reviewing work from their own former department, a consultant who wrote the procedure now checking compliance with it — and note how the facts signal the conflict before any judgment is needed. Confidentiality and integrity operate the same way — findings belong to the engagement and its agreed channels, not to informal adjustment. When a scenario has a manager suggesting that a nonconformity 'doesn't need to be in the report,' the correct response is to retain the finding, document the discussion if relevant, and route any dispute through the audit process rather than private negotiation.

Scope boundaries are the second trap. An auditor who discovers a leaking container reports it as a finding with recommended corrective action for the responsible party; stepping onto the floor to fix or open the container personally exceeds the audit role and creates unmanaged safety exposure. Similarly, offering to redesign the auditee's compliance program converts you from assessor to consultant and undermines the independence of any future audit. In scenario answers, the pattern to demonstrate is: identify, document, classify, recommend — and leave execution with the auditee.

References and further reading

Use these references to explore the concepts and check the latest information from the relevant organizations.

• nrep.org

Continue your preparation

• Certified Environmental Auditor Cea
• Study Guides