Agree the criterion first
Which rule, approval limit or agreed process is being checked? Without a clear criterion the conclusion may look subjective. Define scope, period and sampling boundaries before starting.
Structure the finding
Separate criterion, actual condition, evidence, possible cause and risk. Missing approval evidence in sampled payments does not prove every payment is wrong. State sample size and limitations explicitly.
Track corrective action
Assign an owner, due date and closure evidence. A “resolved” label alone is insufficient: recheck that the control works. This is an internal review approach, not a statutory independent audit opinion.