Reasons to close audit recommendations

‘Open’ and ‘closed’ recommendations – what is ‘closure’? The stages of ‘closure’ Proper and improper bases for ‘closure’

What to read first: Audit recommendation tracking

Auditors Version 1. Beta

Check the vocabulary for audit recommendations

‘Open’ and ‘closed’ recommendations – what is ‘closure’?

Recommendations are ‘open’ when made and accepted. Sometimes a recommendation has been implemented before reporting is formalised, so it never goes through an ‘open’ stage.

‘Closure’ is a decision taken by the audit committee to cease monitoring of the recommendation. The decision is reversible.

The manager accountable for an open recommendation will be asked to report on progress at intervals until such time as the recommendation is closed. In the normal pattern, there will be one or more progress reports, and a final management report declaring that the recommendation has been fully implemented in all material respects, and that any underlying issue has been resolved in a way that would satisfy the audit committee and its constituency. Another end-point is a formal advice from management that the recommendation is no longer warranted, because of a change in the situation.

The audit committee decision to close is usually based on the declaration from management that the recommendation has been implemented or is no longer warranted. Management’s declaration to the committee may be accompanied by commentary from the Chief Audit Executive, or by a verification report from an auditor.

The stages of ‘closure’

  1. Management declares implementation complete, or advises that no further action is needed. (The management declaration is made to the audit committee, usually via Chief Audit Executive staff.)
  2. Chief Audit Executive staff review the declaration in the context of the full history of the recommendation, starting with the original audit finding, that is, with the deficiency requiring the recommendation. Chief Audit Executive staff or auditors may take some steps to verify implementation or rectification. The end result is Chief Audit Executive or auditor advice to the audit committee on closure of the recommendation.
  3. The management declaration and the Chief Audit Executive (or auditor) advice are submitted to the audit committee.
  4. The audit committee agrees to close the recommendation, or defines further action required for closure. The further action could be expected of management, of the Chief Audit Executive, or of the auditor.
  5. The closed recommendation is filed for potential follow-up verification by auditors.

Proper and improper bases for ‘closure’

Proper bases Improper bases
Original issue is resolved (to stakeholders) and no longer warrants any action. The original issue is not actually resolved to reasonable stakeholder satisfaction, but management no longer wants to be accountable for implementation of the recommendation.
Resolution can be: Common pathways to an improper suggestion for closure:
  • A change to the situation along the lines recommended by the audit, with the intended benefit.
  • A change to the larger situation, such that the original issue has become immaterial, or part of an unchangeable past.
  • A change in stakeholder expectations, such that there is no longer any deficiency driving the recommendation.
  • A conspicuous change in the situation that nevertheless allows the fundamental deficiency to continue. The conspicuous change might be a new IT system or a management re-structure. Both are famous for not fixing fundamental problems.
  • Change of responsible manager, or a broader restructure.
  • Commitment to a future change that will address the issue, commonly along the lines of ‘that problem will be fixed when Project X is completed’. That can be a valid response to the recommendation, but it is not a sufficient basis for closing that recommendation. The recommendation can and should stay open until ‘Project X’ has actually fixed the problem (past tense). In the meantime, stakeholders are exposed to the underlying deficiency. That ‘meantime’ can be very long if ‘project X’ takes a long time to finish, or even longer if ‘Project X’ is really just an idea and never even starts.
  • Inadequate resources, funding, or management support for implementation. Such factors can be legitimate, but such claims must not be accepted on face value. If this argument is submitted, the audit committee must reach satisfaction that the story is genuine, that the argument is valid, and that enterprise stakeholders would be satisfied with the decision to continue with the deficiency leading to the recommendation. In most instances these steps have not been taken, so ‘inadequate resources’ (etc.) appears in this list of ‘improper’ bases for closure. The Chief Audit Executive staff may have a lot to challenge and investigate in such a case. An important audit recommendation may become the necessary driver for increased resources, funding or management support.
  • Discovery that the original audit finding was not accurate or reasonable as a basis for the recommendation. In such a case, the audit committee would expect an explanation of why the original error was made. That explanation may reflect badly on both auditors and executive management, though there may also be valid and understandable reasons.
  • Too much time has passed. There may be some truth in such a statement, especially the simple fact of delay. However, allowing delay as an excuse only encourages indefinite deferral of action on future recommendations. The audit committee should be advised of who was responsible for the delay, whether there was Chief Audit Executive follow-up during the delay period, and of management’s earlier statements. The onus is on management to show that the recommendation no longer has any rationale. (This situation is itself a powerful argument for very regular and consistent follow-up by the Chief Audit Executive.)
  • Nobody can now understand the original recommendation. This regrettable position can be reached, as a result of poor audit practice at the time the audit recommendation was ‘agreed’. Management are also partly responsible, through failing to respond constructively at the time of the audit. But reaching this position is not enough to justify closing the recommendation. Asserting that no-one now understands the recommendation creates an obligation to reform audit practices so that no such situation can arise in future. If an old audit recommendation is to be closed on that basis, the Chief Audit Executive should be ready to show that audit practices have changed as necessary.

Parent articles

Audit recommendation tracking

What are audit recommendations? What happens without tracking of audit recommendations What gets tracked The tracking cycle Forecast and target dates for implementing a recommendation When tracking ends: good and bad reasons to ‘close’ an audit recommendation Common problems and solutions in audit recommendation tracking The magic format Reporting to the audit committee The secret is management accountability- for the deficiency

Auditors Version 1.0 Beta

Main article on Audit recommendation tracking

Leave a Reply

Your email address will not be published.

Comments are moderated from a sea of spam, so may not be published immediately. Email contact may get a quicker response.