What to read first: Audit recommendation tracking
|Auditors||Version 1. Beta|
Check the vocabulary for audit recommendations
‘Open’ and ‘closed’ recommendations – what is ‘closure’?
Recommendations are ‘open’ when made and accepted. Sometimes a recommendation has been implemented before reporting is formalised, so it never goes through an ‘open’ stage.
‘Closure’ is a decision taken by the audit committee to cease monitoring of the recommendation. The decision is reversible.
The manager accountable for an open recommendation will be asked to report on progress at intervals until such time as the recommendation is closed. In the normal pattern, there will be one or more progress reports, and a final management report declaring that the recommendation has been fully implemented in all material respects, and that any underlying issue has been resolved in a way that would satisfy the audit committee and its constituency. Another end-point is a formal advice from management that the recommendation is no longer warranted, because of a change in the situation.
The audit committee decision to close is usually based on the declaration from management that the recommendation has been implemented or is no longer warranted. Management’s declaration to the committee may be accompanied by commentary from the Chief Audit Executive, or by a verification report from an auditor.
The stages of ‘closure’
- Management declares implementation complete, or advises that no further action is needed. (The management declaration is made to the audit committee, usually via Chief Audit Executive staff.)
- Chief Audit Executive staff review the declaration in the context of the full history of the recommendation, starting with the original audit finding, that is, with the deficiency requiring the recommendation. Chief Audit Executive staff or auditors may take some steps to verify implementation or rectification. The end result is Chief Audit Executive or auditor advice to the audit committee on closure of the recommendation.
- The management declaration and the Chief Audit Executive (or auditor) advice are submitted to the audit committee.
- The audit committee agrees to close the recommendation, or defines further action required for closure. The further action could be expected of management, of the Chief Audit Executive, or of the auditor.
- The closed recommendation is filed for potential follow-up verification by auditors.
Proper and improper bases for ‘closure’
|Proper bases||Improper bases|
|Original issue is resolved (to stakeholders) and no longer warrants any action.||The original issue is not actually resolved to reasonable stakeholder satisfaction, but management no longer wants to be accountable for implementation of the recommendation.|
|Resolution can be:||Common pathways to an improper suggestion for closure:|
Main article on Audit recommendation tracking