The observation in question includes the condition ( " no approved credit risk management policy " and " 17 out of 50 contacts showed clients with a poor credit history " ) and the cause (the subsidiary concluding contacts with high-risk clients). However, it lacks the effect, which should explain the potential or actual impact of this deficiency on the organization (e.g., financial losses, increased credit risk). Additionally, it is missing the criteria, which should reference the specific rules or policies that are not being followed (e.g., the organization’s credit risk management policy requirements). Including these components would provide a complete and actionable observation.

The Institute of Internal Auditors (IIA) - Practice Guide: Audit Reports and Working Papers