A finding that is written but never closed is a finding that was never written. Which is why follow-up is part of the engagement, not optional extra work.
1 Following up findings
- A central register of every open finding: rating, owner, due date and status.
- A reminder before the due date, not after — a late reminder is a reprimand, not follow-up.
- Real verification before closing: a finding is not closed on management’s word alone, but on evidence that is examined.
- Periodic reporting to the committee on the status of findings, which are overdue, and why.
| Status | What it means |
|---|---|
| Open | Remediation has not started |
| In progress | Started and within the due date |
| Overdue | Past the agreed date |
| Closed | Implemented and verified by audit with evidence |
| Risk accepted | Management declined to remediate and accepted the risk by a documented decision |
Closure in name only
“The finding was closed once the new policy was approved” is not closure. Closure requires evidence that the control operates: a sample of transactions after the change proving it is applied.
2 Escalation
Reminder
Two weeks before the date, to the owner
Alert
On overdue: to the department head
Notification
To the CEO on repeated delay
Escalation
To the audit committee in the periodic report
Graduated escalation, declared in advance — so nobody is caught out and audit is not accused of ambush
3 The quality assurance and improvement programme
Who audits the auditor? The answer: the quality assurance programme — a professional requirement, not a luxury. It has two sides:
| Internal assessment | External assessment | |
|---|---|---|
| Who performs it | The function itself, through working paper review and supervision | A qualified independent party from outside the organisation |
| Frequency | Ongoing and periodic | Periodic, per the applicable professional requirement |
| Output | Improvements in methodology and performance | An opinion on the degree of conformance with the standards |
Declaring conformance
A function may not declare conformance with the professional standards unless it has a quality assurance programme to support that and an external assessment has been carried out. Otherwise the honest course is to disclose the extent of conformance and its limits.
4 Performance indicators for the audit function
| Indicator | What it reveals |
|---|---|
| Percentage of the annual plan completed | Realism of the planning and adequacy of resources |
| Percentage of findings closed on time | Management’s seriousness and the effectiveness of follow-up |
| Average time to issue the report after fieldwork ends | How quickly the insight lands, and its value |
| Findings recurring at the next audit | Weak treatment of the root cause |
| Training hours per auditor | Continuing professional competence |
| Satisfaction of the audit committee and audited areas | Quality of communication and the impact of reports |
An audit function completed 100% of its plan, but 40% of its findings recur at the next audit, and the average time to issue a report is 60 days.
The reading: excellent volume, weak impact. Reports arrive late and lose their value, and the recommendations treat symptoms rather than causes. The remedy: deeper root cause analysis, a shorter issuance cycle, and tracking the impact of recommendations rather than their number.
Chapter 1 summary
- Follow-up is part of the engagement, and closure requires evidence rather than an assertion.
- Escalation is graduated and declared in advance: reminder, alert, notification, escalation to the committee.
- Management’s acceptance of risk is documented and put to whoever owns that decision.
- The quality assurance programme, internal and external, protects the function’s credibility.
- The function is measured by its impact, not by the number of its reports.
5 Test your understanding
Three quick questions
Pick the answer you believe is correct and you will see the result immediately.
1. Management states that it has remediated the finding. When is it closed?
Closure is audit’s decision on examined evidence, not on the audited area’s assertion.
2. What is the purpose of an external assessment of the audit function?
It assesses the function itself — its methodology, quality and conformance — and underpins the credibility of its reports.
3. The same findings recurring at the next audit usually indicates:
Recurrence signals that the recommendation treated the symptom rather than the cause, or that the closure was nominal.