Combining observations into one reported finding can be appropriate when they were noted during the same audit and the action plan has a common owner. In this case, the failure of both the financial reporting function and the AR staff to perform reconciliations regularly is interconnected and points to a systemic issue under the responsibility of the controller. Addressing these issues together can provide a more comprehensive view of the control deficiencies and facilitate more effective remediation. Reference:
The IIA's International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard 2410 - Criteria for Communicating.
The IIA's Practice Advisory on Communicating Results.