Reasons to close audit recommendations

‘Open’ and ‘closed’ recommendations – what is ‘closure’? The stages of ‘closure’ Proper and improper bases for ‘closure’

What to read first: Audit recommendation tracking

• A change to the situation along the lines recommended by the audit, with the intended benefit.
• A change to the larger situation, such that the original issue has become immaterial, or part of an unchangeable past.
• A change in stakeholder expectations, such that there is no longer any deficiency driving the recommendation.

• A conspicuous change in the situation that nevertheless allows the fundamental deficiency to continue. The conspicuous change might be a new IT system or a management re-structure. Both are famous for not fixing fundamental problems.
• Change of responsible manager, or a broader restructure.

• Commitment to a future change that will address the issue, commonly along the lines of ‘that problem will be fixed when Project X is completed’. That can be a valid response to the recommendation, but it is not a sufficient basis for closing that recommendation. The recommendation can and should stay open until ‘Project X’ has actually fixed the problem (past tense). In the meantime, stakeholders are exposed to the underlying deficiency. That ‘meantime’ can be very long if ‘project X’ takes a long time to finish, or even longer if ‘Project X’ is really just an idea and never even starts.
• Inadequate resources, funding, or management support for implementation. Such factors can be legitimate, but such claims must not be accepted on face value. If this argument is submitted, the audit committee must reach satisfaction that the story is genuine, that the argument is valid, and that enterprise stakeholders would be satisfied with the decision to continue with the deficiency leading to the recommendation. In most instances these steps have not been taken, so ‘inadequate resources’ (etc.) appears in this list of ‘improper’ bases for closure. The Chief Audit Executive staff may have a lot to challenge and investigate in such a case. An important audit recommendation may become the necessary driver for increased resources, funding or management support.

• Discovery that the original audit finding was not accurate or reasonable as a basis for the recommendation. In such a case, the audit committee would expect an explanation of why the original error was made. That explanation may reflect badly on both auditors and executive management, though there may also be valid and understandable reasons.

• Too much time has passed. There may be some truth in such a statement, especially the simple fact of delay. However, allowing delay as an excuse only encourages indefinite deferral of action on future recommendations. The audit committee should be advised of who was responsible for the delay, whether there was Chief Audit Executive follow-up during the delay period, and of management’s earlier statements. The onus is on management to show that the recommendation no longer has any rationale. (This situation is itself a powerful argument for very regular and consistent follow-up by the Chief Audit Executive.)
• Nobody can now understand the original recommendation. This regrettable position can be reached, as a result of poor audit practice at the time the audit recommendation was ‘agreed’. Management are also partly responsible, through failing to respond constructively at the time of the audit. But reaching this position is not enough to justify closing the recommendation. Asserting that no-one now understands the recommendation creates an obligation to reform audit practices so that no such situation can arise in future. If an old audit recommendation is to be closed on that basis, the Chief Audit Executive should be ready to show that audit practices have changed as necessary.

Audit recommendation tracking

What are audit recommendations? What happens without tracking of audit recommendations What gets tracked The tracking cycle Forecast and target dates for implementing a recommendation When tracking ends: good and bad reasons to ‘close’ an audit recommendation Common problems and solutions in audit recommendation tracking The magic format Reporting to the audit committee The secret is management accountability- for the deficiency