How directors can read a control findings memo without drowning in annexes

A findings memo is a ranking of exceptions, not a report card on the company’s character. High severity usually means a control that should have prevented material misstatement or customer harm failed, or that evidence of its operation was absent.

Read the severity definitions first. Then read the top three exceptions with their population and sample sizes. If an annex is longer than the main memo, ask management to walk the board through only the items that change residual risk for the next quarter.

Useful director questions sound concrete: Which payment rail does this touch? How many days can the exception remain open under policy? Who owns remediation, and what evidence will prove closure?

Avoid treating every medium finding as equal urgency. A missing second signature on fee waivers may be more urgent than a cosmetic gap in a rarely used report template—depending on volumes.

If language in the memo feels unclear, ask for a board control briefing. Translating fieldwork into minutes-ready wording is part of governance hygiene, not a luxury.