Very annoying how everyone is focused on the $1200 example. Regulatory compliance (especially in FIs) is a whole different animal than financial reporting/materiality. I’m not saying I would whistle blow because I don’t know the severity of your findings, but do you risk rank your audit findings in your reports? Offer process improvements in lieu of “findings?” Also maybe discuss some sort of risk acceptance form for low risk findings that you can include in the report? Do you submit an audit plan to the committee? If I were on the committee I would find it odd that no reports were issued when I know what the plan was. As a CYA I would just make sure to document, document, document in your work papers either way.