Follow Up and Remediation Tracking
Findings get agreed, action plans get signed, and a year later the same findings appear again. The failure is rarely bad faith. It is that nobody owns the register, closure is claimed rather than tested, and the audit committee sees a list of open items with no sense of whether the position is improving or decaying.
1
Consolidate
One register, all sources
2
Assign
Owner and due date
3
Monitor
Progress against plan
4
Retest
Verify before closing
5
Report
Trend to the committee
How We Track
01
Consolidating the Register
Findings arrive from internal audit, external audit, regulators and management reviews, and they are usually tracked in separate places or not at all. One register makes the true open position visible, which is frequently worse than any individual list suggested.
- All sources consolidated into a single register
- Duplicate findings across sources identified and merged
- Ageing calculated from original raise date
- True open position established as a baseline
02
Ownership and Action Plans
A finding without a named owner and a date does not get fixed. We work with management to assign both, and challenge action plans that address the symptom rather than the cause.
- Named individual owner per finding
- Agreed due dates that are actually achievable
- Action plans challenged where they treat symptoms
- Escalation path defined for missed dates
03
Monitoring and Escalation
Progress is monitored between committee meetings rather than reported only at them. Items slipping repeatedly are escalated while there is still time to intervene.
- Regular progress checks between meetings
- Early flagging of items at risk of slipping
- Escalation of repeatedly deferred findings
- Revised dates approved rather than quietly adjusted
04
Retesting and Closure
A finding closes when the control has been observed operating, not when management reports completion. This single discipline eliminates most repeat findings.
- Retesting against evidence before closure
- Sample sizes appropriate to the control frequency
- Closure recorded with the evidence supporting it
- Findings reopened where retesting fails
05
Trend Reporting
The committee needs the direction of travel, not just a list. Closure rates, ageing profile and repeat finding analysis tell a board whether management is genuinely resolving issues.
- Closure rate reported per period
- Ageing profile of open findings
- Repeat finding analysis by cause and area
- Reporting pack aligned to the committee cycle
What You Receive
- Consolidated findings register across all assurance sources
- Named owner and agreed due date per finding
- Action plans reviewed for root cause treatment
- Retest evidence supporting every closure
- Repeat finding analysis by cause and area
- Committee reporting pack with closure and ageing trends
Indicative Timeline
Establishing the register takes two to three weeks. Thereafter tracking is continuous, with reporting aligned to the audit committee cycle rather than run as a project.
- Register consolidation: one to two weeks
- Owner and date assignment with management: one week
- Monitoring: continuous between meetings
- Retesting and reporting: aligned to the committee cycle
Why Findings Repeat
Across engagements the same handful of causes produce most repeat findings, whatever the observation says.
No Named Owner
A finding assigned to a department is assigned to nobody, and nobody is who fixes it.
Symptom Level Action
Removing the excess access closes the observation. Building the leaver process closes the finding.
Closure Without Testing
Accepting a management assertion of completion, which is the single largest source of repeats.
Unrealistic Dates
Dates agreed to end an uncomfortable meeting slip, then slip again, then stop being taken seriously.
No Evidence Generated
A remediated control that produces no artefact cannot be tested and will be raised again.
Fragmented Registers
Findings tracked separately per source, so nobody ever sees the total open position.
Frequently Asked Questions
Why not just track findings in a spreadsheet?
You can, and many do. The failure is rarely the tool. It is that nobody owns it, closure is not tested, and it is updated the week before the committee meets. The discipline matters more than the system.
Who should close a finding?
Not the person who remediated it. Closure requires independent verification that the control now operates, which is why retesting sits with internal audit rather than with management.
What if management disputes a finding?
Their position is recorded alongside it, unedited, and both go to the committee. A disputed finding stays open until the committee decides. It is not closed because it is unwelcome.
How do we handle findings we cannot afford to fix?
Formal risk acceptance, approved at the right level and recorded with a review date. That is a legitimate outcome. What is not legitimate is an action plan nobody intends to execute.
What is a reasonable closure rate?
Direction matters more than the absolute number. A rising closure rate with a falling ageing profile indicates a functioning process. A stable closure rate alongside growing ageing means the easy items are being closed and the difficult ones are not.
Can you track findings raised by our external auditors?
Yes, and combining them into one register is the point. Findings tracked separately per source mean nobody ever sees the total open position, which is what the committee actually needs.
Related Services
This sits inside our Internal Audit practice. Related work: Audit Finding Remediation where ICT findings need fixing rather than tracking, and Combined Assurance for the wider coverage picture.
