08 Audit Follow-Up and Remediation Tracking

Issuing the audit report does not remove the risk.

A finding remains relevant until management either:

Remediates the Risk

or:

Formally Accepts
the Residual Risk

The purpose of audit follow-up is to determine whether:

Agreed Actions
Were Completed

and whether those actions:

Actually Addressed
the Finding

A practical remediation lifecycle looks like:

Final Audit Report
      ↓
Finding
      ↓
Management Action Plan
      ↓
Action Owner
      ↓
Target Date
      ↓
Progress Monitoring
      ↓
Remediation Evidence
      ↓
Audit Validation
      ↓
Retesting
      ↓
Residual Risk
      ↓
Close / Keep Open / Reopen
      ↓
Management Reporting

Learning Objectives

By the end of this lesson, you will be able to:

Explain the purpose of audit follow-up.
Understand finding lifecycle management.
build a remediation tracking process.
track management action plans.
identify accountable remediation owners.
manage remediation due dates.
monitor open findings.
calculate finding aging.
identify overdue remediation.
manage remediation extensions.
evaluate extension requests.
review remediation evidence.
distinguish implementation from effectiveness.
validate partial remediation.
perform audit retesting.
evaluate residual risk after remediation.
close audit findings.
keep findings open when remediation is insufficient.
reopen previously closed findings when appropriate.
manage risk-accepted findings.
identify repeat findings.
escalate overdue high-risk actions.
develop remediation KPIs and KRIs.
build an executive remediation dashboard.
maintain audit-trail evidence for closure decisions.

1. What Is Audit Follow-Up?

Audit follow-up is the process used to determine whether management has:

Implemented
Agreed Actions

and reduced the identified risk to an acceptable level.

It connects:

Audit Reporting

to:

Risk Reduction

2. Why Follow-Up Matters

Without follow-up:

Audit Finding
      ↓
Report Issued
      ↓
Management Agrees
      ↓
Nothing Changes

A mature process requires:

Finding
      ↓
Owner
      ↓
Action
      ↓
Due Date
      ↓
Evidence
      ↓
Validation
      ↓
Closure

3. Audit Follow-Up Objective

The auditor should answer:

Was the Action
Implemented?

Was It Implemented
as Agreed?

Does It Address
the Root Cause?

Is the Control
Operating?

Has the Risk
Been Reduced?

4. Finding Lifecycle

A typical finding lifecycle may use:

Draft

Validated

Open

In Progress

Pending Evidence

Pending Validation

Closed

Risk Accepted

Some organizations may also use:

Overdue

Extended

Reopened

5. Create Finding Follow-Up Register

Create:

01 Finding Follow-Up Register

Use:

Finding ID	Finding	Severity	Owner	Target Date	Status	Days Open

6. Include Action Plans

Extend the register with:

Management Action

Action Owner

Original Due Date

Current Due Date

Progress

Evidence Received

Validation Result

Closure Date

7. Original Due Date

Always retain:

Original Target Date

even if the date is later extended.

This preserves:

Remediation History

8. Current Due Date

Also track:

Current Approved
Due Date

so users can distinguish:

Original Commitment

from:

Approved Extension

9. Finding Severity

Follow-up priority should consider:

Critical

High

Medium

Low

10. Risk-Based Follow-Up

Not every finding requires the same level of monitoring.

Example:

Critical

Immediate Monitoring

Frequent Management Updates

Executive Escalation

Interim Controls

High

Monthly Monitoring

Senior Owner Oversight

Formal Validation

Medium

Periodic Monitoring

Low

Standard Follow-Up

11. Action Owner

Each remediation should have:

Accountable Owner

Avoid:

IT Team

Prefer:

Director of Identity
and Access Management

12. Why Ownership Matters

Without clear ownership:

Everyone
Is Responsible

often becomes:

No One
Is Accountable

13. Management Action Plan

A good action plan should explain:

What Will
Be Changed?

Who Will
Do It?

When?

How Will
Completion Be Demonstrated?

14. Weak Action Plan

IAM Will
Improve the Process

15. Stronger Action Plan

IAM will implement
daily reconciliation
between HR terminations
and active accounts,
with automated escalation
for unmatched records.

16. Remediation Milestones

Large remediation may require intermediate milestones.

Example:

Design

Development

Testing

Pilot

Production

Validation

17. Milestone Tracker

Create:

02 Remediation Milestone Tracker

Use:

Finding	Milestone	Owner	Target	Status

18. Progress Status

Use standardized values:

Not Started

In Progress

At Risk

Completed

Pending Validation

19. Avoid “90% Complete” Without Evidence

Statements such as:

90% Complete

may be misleading unless linked to defined milestones.

Prefer:

Configuration Complete

Testing Pending

Production Deployment
Scheduled

20. Monitor Finding Aging

Finding aging measures:

How Long
the Finding
Has Remained Open

21. Finding Age

Conceptually:

Current Date
-
Finding Open Date
=
Days Open

22. Aging Buckets

Create:

0–30 Days

31–60 Days

61–90 Days

91–180 Days

180+ Days

23. Finding Aging Dashboard

Create:

03 Finding Aging Dashboard

Example:

Aging	Findings
0–30 days	8
31–60 days	6
61–90 days	4
91–180 days	3
180+ days	2

24. Why Aging Matters

Compare:

10 High Findings

with:

10 High Findings,
8 of Which
Are Over 180 Days Old

The second represents a more serious governance concern.

25. Overdue Finding

A finding becomes overdue when:

Current Date
>
Approved Due Date

and required remediation is incomplete.

26. Overdue Status

Track:

Days Overdue

separately from:

Days Open

27. Example

Finding opened:

1 January

Due:

31 March

Current date:

30 April

Result:

Days Open:
119

Days Overdue:
30

28. Overdue Findings Require Escalation

Example:

Finding Due
      ↓
Owner Reminder
      ↓
Senior Owner
      ↓
Audit Leadership
      ↓
Executive Management
      ↓
Audit Committee

depending on severity and governance.

29. Escalation Matrix

Create:

04 Finding Escalation Matrix

Example:

Condition	Escalation
Medium finding 30 days overdue	Process Owner
High finding overdue	Executive Owner
Critical finding overdue	Immediate Executive / Audit Committee
Repeat overdue finding	Audit Leadership
Expired risk acceptance	Risk Committee

30. Remediation Extensions

Sometimes remediation cannot be completed by the original date.

Examples:

Technology Dependency

Budget Approval

Vendor Dependency

Major Migration

Resource Constraint

31. Extension Is Not Automatic

Avoid:

Due Date Approaching
      ↓
Change the Date

Instead:

Extension Request
      ↓
Risk Review
      ↓
Justification
      ↓
Interim Controls
      ↓
Approval

32. Create Extension Request Record

Create:

05 Extension Request Record

Include:

Finding

Original Due Date

Requested Date

Reason

Work Completed

Remaining Work

Interim Controls

Residual Risk

Approver

33. Evaluate Extension Request

Ask:

Why Is
Extension Needed?

Could Management
Have Avoided Delay?

What Risk
Remains?

Are Interim Controls
Operating?

Is New Date
Realistic?

Who Approved
the Extension?

34. Repeated Extensions

Multiple extensions may indicate:

Weak Ownership

Insufficient Resources

Poor Planning

Management Risk Acceptance

and may warrant escalation.

35. Retain Extension History

Do not overwrite:

Original Due Date

Maintain:

Extension 1

Extension 2

Extension 3

for transparency.

36. Remediation Evidence

Management should submit evidence demonstrating:

Action Completed

37. Create Remediation Evidence Tracker

Create:

06 Remediation Evidence Tracker

Use:

Finding	Evidence ID	Evidence	Received	Validated	Result

38. Common Remediation Evidence

Examples:

Updated Policy

Updated Procedure

System Configuration

Implementation Ticket

Training Record

System Report

Logs

Screenshots

Test Results

39. Evidence Must Match the Finding

Finding:

Admin MFA
Not Enforced

Weak closure evidence:

Updated MFA Policy

Better evidence:

MFA Configuration

Admin Population

Exception Analysis

40. Policy Change vs Control Change

A policy update may address:

Documentation

but not necessarily:

Actual Control Operation

41. Implementation vs Effectiveness

One of the most important follow-up concepts:

Implemented
≠
Effective

42. Example

Management implements:

New Quarterly
Access Review Tool

Audit should still determine:

Were Reviews
Actually Completed?

Were Populations
Complete?

Were Exceptions
Removed?

43. Closure Validation

Create:

07 Closure Validation Worksheet

Suggested sections:

Finding

Original Condition

Root Cause

Management Action

Evidence

Validation Procedure

Retest

Residual Risk

Closure Decision

44. Closure Validation Questions

Ask:

Was the Action
Implemented?

Does It Address
the Root Cause?

Does the New Control
Address the Risk?

Has It Operated
Long Enough?

Is Evidence
Sufficient?

Does Risk
Remain?

45. Retesting

Retesting independently evaluates whether remediation:

Operates Effectively

46. Create Retesting Workpaper

Create:

08 Retesting Workpaper

Include:

Finding

Remediation

Control

Population

Testing Period

Procedure

Evidence

Results

Conclusion

47. Retesting Scope

Retesting should focus on:

Affected Control

Root Cause

Population

Risk

not necessarily repeat the entire original audit.

48. Example — Termination Finding

Original finding:

29 of 420
Terminated Accounts
Exceeded SLA

Management implements:

Daily HR/IAM
Reconciliation

Follow-up testing might:

Review 90 Days
of Terminations

Analyze All
Termination Events

Verify Exceptions
Are Escalated

49. Appropriate Operating Period

A new control may need time to operate before effectiveness can be validated.

Example:

Quarterly Control
Implemented Yesterday

may not yet provide evidence of:

Quarterly
Operating Effectiveness

50. Interim Closure

Some methodologies may permit:

Implementation Complete
Pending Operating Validation

but this should not be confused with full closure unless methodology permits it.

51. Partial Remediation

Management may complete:

Some

but not:

All

required actions.

Example:

MFA Enabled
for AWS

Not Enabled
for Azure

52. Partial Remediation Decision

Possible outcomes:

Keep Finding Open

Reduce Scope

Update Residual Risk

Create Separate Action

according to audit methodology.

53. Do Not Close Based on Percentage Complete

Avoid:

90% Remediated
=
Closed

The unresolved:

10%

may contain the highest-risk exposure.

54. Residual Risk Assessment

After remediation determine:

What Risk
Still Remains?

55. Residual Risk Flow

Original Risk
      ↓
Remediation
      ↓
Control Effectiveness
      ↓
Remaining Gaps
      ↓
Residual Risk

56. Example

Original:

High Risk

after remediation:

MFA Enforced
for 98%
of Admin Accounts

Remaining:

2%
Service Accounts
Without MFA

Residual risk requires separate analysis.

57. Finding Closure

A finding may be closed when:

Actions Completed

Root Cause Addressed

Evidence Sufficient

Retesting Successful

Residual Risk Acceptable

58. Closure Decision

Use:

CLOSE

only when the evidence supports it.

59. Keep Open

Use:

KEEP OPEN

when:

Action Incomplete

Evidence Insufficient

Retesting Failed

Risk Remains Material

60. Closure Note

Create:

Finding Closure Note

Example:

Internal Audit reviewed
the implemented HR/IAM
reconciliation process
and analyzed all employee
terminations occurring
between May and July.

All 218 termination
events were processed
within the approved SLA,
and no unmatched active
accounts were identified.

The finding is therefore
closed.

61. Closure Evidence Should Be Traceable

Maintain:

Finding
      ↓
Management Action
      ↓
Evidence
      ↓
Retest
      ↓
Closure Decision

62. Closure Approval

Depending on severity, closure may require:

Auditor

Audit Manager

Head of Internal Audit

approval.

63. Reopen Finding

A previously closed finding may need to be reopened when:

Remediation Reversed

Control Stops Operating

Evidence Was Incorrect

Same Condition Recurs
Soon After Closure

64. Reopened vs Repeat Finding

These concepts may differ.

Reopened

The original finding was closed but:

Closure Is No Longer
Considered Valid

Repeat

A later audit identifies:

Same or Similar
Control Weakness

again.

Use methodology-specific definitions.

65. Create Reopened Finding Record

Create:

09 Reopened Finding Record

Include:

Original Finding

Closure Date

Reason Reopened

New Evidence

Current Risk

New Action

66. Repeat Findings

Repeat findings can indicate:

Ineffective Remediation

Wrong Root Cause

Weak Governance

Unsustainable Control

67. Repeat Finding Analysis

Ask:

Was Previous Action
Actually Completed?

Was Closure Testing
Sufficient?

Did the Environment
Change?

Was Root Cause
Correctly Identified?

68. Risk Acceptance

Sometimes management decides not to remediate.

Use:

Risk Acceptance

instead of falsely treating:

Finding
as Remediated

69. Risk Acceptance Tracker

Create:

10 Risk Acceptance Tracker

Use:

Finding	Severity	Risk Owner	Approval	Expiry	Status

70. Risk Acceptance Requirements

Verify:

Correct Authority

Documented Rationale

Residual Risk

Compensating Controls

Review Date / Expiry

71. Audit Finding vs Risk Acceptance

A risk-accepted finding may remain:

Closed for
Remediation Tracking

or:

Tracked Separately

depending on methodology.

Do not erase the historical finding.

72. Expired Risk Acceptance

At expiry:

Risk Acceptance
      ↓
Reassess
      ↓
Remediate / Renew / Escalate

73. Do Not Automatically Renew

Require:

Current Risk Review

Business Justification

Updated Approval

74. Management Certification

Some organizations ask management to periodically certify:

Action Status

Risk Exposure

Completion

This supports governance but does not replace audit validation.

75. Evidence Submission Workflow

Management
Submits Evidence
      ↓
Audit Logs Receipt
      ↓
Evidence Review
      ↓
Sufficient?
      │
   ┌──┴──┐
  No    Yes
  ↓      ↓
Request  Retest
More

76. Evidence Rejection

Evidence may be rejected when:

Wrong Period

Wrong System

Incomplete

Not Relevant

Unsupported Screenshot

Policy Only

No Operating Evidence

77. Communicate Evidence Gaps Clearly

Example:

The submitted procedure
demonstrates that the
new process was documented,
but it does not demonstrate
that the control has
operated.

Please provide completed
review evidence for the
period following implementation.

78. Remediation Quality

Strong remediation should:

Address Root Cause

Reduce Risk

Be Sustainable

Have Ownership

Produce Evidence

Be Monitorable

79. Weak Remediation

Finding:

Access Reviews
Frequently Missed

Weak action:

Remind Managers
to Complete Reviews

80. Stronger Remediation

Automated Review Workflow

Reminders

Escalation

Completion Monitoring

Exception Tracking

81. Sustainable Remediation

Ask:

Will This Control
Still Work
Next Year?

not just:

Did Management
Fix Today's Issue?

82. Compensating Controls During Remediation

If permanent remediation will take time:

Permanent Fix
      ↓
Months Away

consider interim:

Compensating Controls

83. Example

Permanent remediation:

Automated
Termination Integration

takes six months.

Interim:

Daily Manual
HR/IAM Reconciliation

84. Validate Interim Controls

Audit should determine whether interim controls:

Address the Risk

Operate Consistently

Have Evidence

85. High-Risk Open Findings

Maintain specific oversight for:

Critical

High

Repeat

Overdue

findings.

86. High-Risk Finding Register

Create:

11 High-Risk Finding Register

Use:

Finding	Severity	Owner	Due	Days Overdue	Escalation

87. Executive Reporting

Executives should understand:

How Many
High-Risk Findings
Remain Open?

Which Are Overdue?

Which Are Repeated?

Who Owns Them?

Why Are They
Still Open?

What Decision
Is Required?

88. Executive Remediation Dashboard

Create:

12 Executive Remediation Dashboard

Recommended metrics:

Open Findings

Critical Findings

High Findings

Overdue Findings

Repeat Findings

Average Age

Oldest Finding

Extensions

Risk Acceptances

Closures

89. Dashboard Example

Metric	Result
Open findings	28
Critical	1
High	6
Overdue	8
180+ days old	4
Repeat findings	3
Risk accepted	2
Closed this quarter	12

90. KPI — Finding Closure Within SLA

Findings Closed
Within Due Date
──────────────── × 100
Findings Due

91. KPI — On-Time High-Risk Remediation

High Findings
Closed on Time
────────────── × 100
High Findings Due

92. KPI — Closure Validation Timeliness

Closure Reviews
Completed Within SLA
──────────────────── × 100
Closure Reviews Due

93. KPI — Remediation Evidence Quality

Possible metric:

Evidence Submissions
Accepted First Time
─────────────────── × 100
Evidence Submissions

Use carefully; it measures process quality rather than risk directly.

94. KRI — Overdue High Findings

High Findings
Past Approved
Remediation Date

95. KRI — Critical Findings Open

Target may be:

depending on risk appetite.

96. KRI — Repeat Findings

Repeat Findings
Identified During
Current Period

97. KRI — Aging Findings

Track:

High Findings
Open >180 Days

98. KRI — Excessive Extensions

Track:

Findings With
2+ Extensions

99. KRI — Expired Risk Acceptances

Target:

100. Trend Reporting

Compare:

Previous Quarter

with:

Current Quarter

Example:

Metric	Previous	Current	Trend
Open High Findings	4	7	↑
Overdue Findings	3	8	↑
180+ Day Findings	1	4	↑
Repeat Findings	1	3	↑

This indicates:

Deteriorating
Remediation Performance

101. Root Cause of Remediation Delays

If findings repeatedly become overdue, ask:

Why?

Possible program-level causes:

Weak Accountability

No Executive Oversight

Resource Constraints

Poor Action Planning

Technology Dependency

Unrealistic Due Dates

Low Risk Ownership

102. Systemic Remediation Issue

If many findings remain overdue across teams:

Individual Finding Delay
      ↓
Common Pattern
      ↓
Governance Weakness

This may itself become an audit or risk theme.

103. Audit Committee Reporting

Audit Committee reporting may include:

Critical Open Findings

Overdue High Findings

Repeat Findings

Management Extensions

Risk Acceptances

Major Closure Activity

Escalations

104. Long-Running Findings

A finding open for:

2 Years

should trigger questions such as:

Is Management
Actually Remediating?

Has Risk
Been Accepted?

Is Due Date
Still Meaningful?

Should Issue
Be Escalated?

105. Finding Closure Does Not Erase History

Retain:

Original Finding

Evidence

Actions

Extensions

Closure Work

for future:

Audit

Regulatory Review

Trend Analysis

Repeat Finding Analysis

106. Historical Finding Repository

Maintain:

Open

Closed

Risk Accepted

Reopened

findings in an authoritative repository.

107. Audit Trail

A reviewer should be able to trace:

Original Finding
      ↓
Management Response
      ↓
Actions
      ↓
Progress Updates
      ↓
Extensions
      ↓
Evidence
      ↓
Retesting
      ↓
Closure Decision

108. Quality Assurance

Audit management should review significant closure decisions.

Questions:

Was Evidence
Sufficient?

Was Retesting
Appropriate?

Was Operating Period
Sufficient?

Was Root Cause
Addressed?

Is Closure
Defensible?

109. Example — MFA Finding

Original condition:

7 of 250
Privileged Accounts
Without MFA

Management action:

Enforce MFA
Through Conditional
Access

Evidence:

Policy Configuration

Admin Population

MFA Status Export

Retest:

250 Accounts

250 Protected

Conclusion:

Close

110. Example — Quarterly Review Finding

Original:

2 of 4 Reviews
Not Completed

Management action:

Automated Quarterly
Review Workflow

Evidence received immediately after implementation.

Question:

Can Audit
Validate Operating
Effectiveness Yet?

Possibly not.

The control may need to operate through an appropriate review cycle first.

111. Example — Cloud Logging

Original:

4 of 100
Cloud Accounts
Without Logging

Remediation:

Enable Logging
on the 4 Accounts

But root cause was:

New Accounts
Not Automatically
Enrolled

Audit should ask:

Will Future
Accounts Still
Be Missed?

If yes:

Root Cause
Not Addressed

finding should remain open.

112. Example — Vendor Assessments

Original:

6 of 50
Tier 1 Vendors
Without Current
Assessment

Management completes the six assessments.

But:

No Reconciliation
Control Implemented

Potential conclusion:

Immediate Condition
Corrected

Underlying Root Cause
Not Remediated

113. Example — Vulnerability Finding

Original:

8 Critical
Vulnerabilities
Past SLA
Without Exception

Management patches all eight.

Audit should also validate:

Why They Became
Overdue

Whether Patch
Governance Improved

Whether Similar
Critical Vulnerabilities
Remain Overdue

114. Example — Risk Acceptance

Finding:

Legacy Application
Does Not Support MFA

Management plans replacement in:

12 Months

Risk acceptance requires:

Appropriate Owner

Compensating Controls

Expiry

Migration Plan

Periodic Review

115. Practical Follow-Up Workflow

Finding Due Soon
      ↓
Request Status
      ↓
Management Update
      ↓
Completed?
      │
 ┌────┴────┐
No         Yes
↓           ↓
At Risk?   Request Evidence
│              ↓
├─ No → Monitor
│
└─ Yes → Escalate
               ↓
        Evidence Sufficient?
               │
          ┌────┴────┐
         No         Yes
         ↓           ↓
   Request More    Retest
                      ↓
               Effective?
                   │
              ┌────┴────┐
             No         Yes
             ↓           ↓
         Keep Open      Close

116. Finding Follow-Up Checklist

Finding Setup

final finding recorded.
severity recorded.
owner assigned.
action plan recorded.
original due date recorded.
required closure evidence defined.

Monitoring

status updates obtained.
milestones tracked.
days open calculated.
days overdue calculated.
high-risk findings prioritized.
repeat findings flagged.

Extensions

extension formally requested.
justification reviewed.
remaining risk evaluated.
interim controls reviewed.
new date assessed.
approval documented.
original date retained.

Evidence

evidence submitted.
evidence logged.
scope validated.
period validated.
implementation validated.
operating evidence obtained where necessary.

Retesting

retesting procedure defined.
population identified.
period appropriate.
evidence sufficient.
control effectiveness evaluated.
residual risk assessed.

Closure

root cause addressed.
agreed actions completed.
retesting passed.
unresolved scope understood.
residual risk acceptable.
closure note completed.
approval obtained.

Risk Acceptance

accepting authority valid.
risk documented.
compensating controls documented.
expiry established.
future review scheduled.

Reporting

open findings reported.
overdue findings reported.
aging reported.
repeat findings reported.
extensions reported.
risk acceptances reported.
significant closures reported.

Audit Follow-Up Deliverables

At completion, you should be able to create:

01 Finding Follow-Up Register

02 Remediation Milestone Tracker

03 Finding Aging Dashboard

04 Finding Escalation Matrix

05 Extension Request Record

06 Remediation Evidence Tracker

07 Closure Validation Worksheet

08 Retesting Workpaper

09 Reopened Finding Record

10 Risk Acceptance Tracker

11 High-Risk Finding Register

12 Executive Remediation Dashboard

Practical Activity — Termination Finding

Original finding:

29 of 420
Termination Accounts
Exceeded SLA

Severity:

High

Action:

Implement Daily
HR/IAM Reconciliation

Management says:

Completed

Evidence:

Updated Procedure

Screenshot of
New Dashboard

Determine:

Is Evidence
Sufficient?

What Operating
Evidence Is Needed?

What Retest
Should Be Performed?

Can the Finding
Be Closed?

Practical Activity — Cloud Logging

Original:

4 Cloud Accounts
Without Audit Logging

Management enables logging on all four.

However:

No Automated
Enrollment for
New Accounts

Determine:

Condition Corrected?

Root Cause Corrected?

Risk Reduced?

Close or Keep Open?

Practical Activity — Overdue High Finding

Finding:

High Severity

Original due date:

30 June

Management requests:

31 December

because of platform migration.

Determine:

Is Six-Month
Extension Reasonable?

What Interim Controls
Exist?

What Residual Risk
Remains?

Who Should Approve?

Practical Activity — Partial Remediation

Finding covered:

AWS

Azure

GCP

Management remediates:

AWS

Azure

but not:

GCP

Determine:

Can the Finding
Be Closed?

Should Severity
Change?

Should Scope
Be Split?

Practical Activity — Repeat Finding

2025:

Quarterly Access
Reviews Missing

Closed after management submitted:

Completed Review
Evidence

2026 audit finds:

Quarterly Reviews
Again Missing

Determine:

Was Previous
Root Cause Fixed?

Was Closure
Validation Sufficient?

Is This a
Repeat Finding?

What Governance
Issue May Exist?

Practical Activity — Risk Acceptance

Management cannot remediate a:

High-Risk Legacy
Authentication Weakness

for:

9 Months

Determine:

What Compensating
Controls Are Needed?

Who Can
Accept Risk?

What Expiry
Should Apply?

How Will Audit
Monitor It?

Common Audit Follow-Up Mistakes

Mistake 1 — Report Issued, Finding Forgotten

Audit value is lost without remediation tracking.

Mistake 2 — Due Date Continuously Changed

Overdue performance becomes invisible.

Mistake 3 — Management Says “Complete” and Finding Is Closed

Completion requires evidence and validation.

Mistake 4 — Policy Accepted as Proof of Operation

A documented process may never actually operate.

Mistake 5 — Only Original Exceptions Corrected

Root cause remains.

Mistake 6 — Partial Remediation Treated as Complete

Unresolved high-risk exposure may remain.

Mistake 7 — New Control Tested Too Early

There may be insufficient operating history.

Mistake 8 — Extensions Approved Without Risk Review

The organization may unknowingly continue carrying unacceptable risk.

Mistake 9 — Interim Controls Not Tested

Temporary controls may not actually reduce risk.

Mistake 10 — Risk Acceptance Used to Avoid Remediation Governance

Acceptance requires appropriate authority and documentation.

Mistake 11 — Finding Closed Without Residual-Risk Assessment

Remaining exposure may be ignored.

Mistake 12 — Repeat Findings Not Identified

Management and governance bodies lose visibility into ineffective remediation.

Mistake 13 — Reopened Findings Hidden

Closure quality issues may not be visible.

Mistake 14 — No Escalation of Overdue High Findings

Risk remains unresolved without senior visibility.

Mistake 15 — Closure Documentation Is Weak

Future auditors cannot determine why the finding was closed.

Weak Remediation Tracking

Finding
      ↓
Management Says
Fixed
      ↓
Close

Strong Remediation Tracking

Finding
      ↓
Root Cause
      ↓
Action Plan
      ↓
Accountable Owner
      ↓
Due Date
      ↓
Progress Monitoring
      ↓
Evidence
      ↓
Validation
      ↓
Retesting
      ↓
Residual Risk
      ↓
Closure Decision
      ↓
Management Reporting

GRC Analyst and Audit Follow-Up

GRC professionals may support remediation by:

maintaining issue registers.
tracking corrective actions.
coordinating evidence collection.
monitoring due dates.
identifying overdue actions.
coordinating risk acceptance.
preparing remediation dashboards.
tracking control changes.
maintaining risk registers.
coordinating with control owners.
supporting audit evidence requests.

Internal Audit should still maintain:

Independent Validation

when closing Internal Audit findings.

Audit Follow-Up Mindset

For every open finding ask:

What Was
the Original Risk?

What Was
the Root Cause?

What Did Management
Agree to Do?

Who Owns
the Action?

What Was
the Original
Due Date?

Has the Date
Changed?

Why?

What Risk
Still Exists?

Are Interim Controls
Operating?

What Evidence
Shows Completion?

Does the Evidence
Match the Finding?

Was the Control
Actually Implemented?

Has It Operated
Long Enough?

Should We
Retest?

What Population
Should We Test?

Did Remediation
Address the
Root Cause?

Is the Control
Sustainable?

What Residual
Risk Remains?

Should the Finding
Be Closed?

Should It
Remain Open?

Should It
Be Escalated?

Is This
a Repeat Issue?

Can We Defend
the Closure Decision
to Management,
Auditors,
and Regulators?

That is the practical mindset behind professional audit follow-up and remediation tracking.

Key Takeaways

Audit findings remain relevant until risk is remediated or formally accepted.
Audit follow-up connects reporting to actual risk reduction.
Every finding should have an accountable owner, action plan, and target date.
Original due dates should be retained even when extensions are approved.
Finding aging and overdue status provide important governance information.
Remediation extensions should require justification and risk review.
Repeated extensions can indicate weak accountability or ineffective remediation governance.
Management’s statement that remediation is complete is not sufficient for closure.
Remediation evidence should directly address the original finding.
Implementation and operating effectiveness are different concepts.
New controls may need an appropriate operating period before effectiveness can be validated.
Partial remediation should not automatically result in closure.
Audit retesting should focus on the affected control, root cause, and risk.
Findings should close only when corrective actions are complete and residual risk is acceptable.
Root causes must be addressed, not only individual exceptions.
Previously closed findings may need to be reopened if remediation is later found ineffective.
Repeat findings often indicate ineffective corrective action or weak governance.
Risk acceptance should follow formal authorization and should not erase finding history.
Expired risk acceptances should trigger reassessment.
High-risk and overdue findings require proportionate escalation.
Executive reporting should highlight aging, overdue, repeat, and high-risk findings.
Closure decisions should be supported by traceable evidence and review.
Strong remediation tracking demonstrates whether Internal Audit is producing lasting risk reduction.

Knowledge Check

Before continuing, make sure you can answer:

What is audit follow-up?
Why is remediation tracking important?
What information should a Finding Follow-Up Register contain?
Why should the original remediation due date be retained?
What is finding aging?
What is the difference between days open and days overdue?
Why should high-risk overdue findings be escalated?
What is a remediation extension?
What should be evaluated before approving an extension?
Why are repeated extensions a governance concern?
What is remediation evidence?
Why does an updated policy not necessarily prove remediation?
What is the difference between implementation and effectiveness?
What is closure validation?
What is audit retesting?
Why might a newly implemented quarterly control not be ready for effectiveness testing?
What is partial remediation?
Why should a finding not close based on percentage completion?
What is residual risk after remediation?
What criteria should generally be met before closing a finding?
When should a finding remain open?
What is a reopened finding?
What is the difference between a reopened and repeat finding?
Why are repeat findings significant?
How should risk-accepted findings be managed?
Why should risk acceptance have an expiry or review date?
What are useful remediation KPIs?
What are useful remediation KRIs?
What should executives see in a remediation dashboard?
What evidence makes a finding-closure decision defensible?

What’s Next?

➡️ Next: 09 — Compliance Assessments

In the next lesson, you will move from Internal Audit into structured compliance-assessment activities used to determine whether an organization meets applicable regulatory, contractual, framework, and internal requirements.

You will work through:

Compliance Requirement
      ↓
Applicability
      ↓
Control Mapping
      ↓
Evidence Requirement
      ↓
Assessment Procedure
      ↓
Evidence Review
      ↓
Compliant / Partial / Non-Compliant
      ↓
Gap
      ↓
Remediation
      ↓
Attestation / Reporting

You will learn how to perform requirement interpretation, applicability analysis, control mapping, evidence collection, assessment testing, compliance scoring, gap analysis, remediation tracking, readiness assessments, certification preparation, and compliance reporting.

You will also build practical artifacts including a Compliance Requirements Register, Applicability Matrix, Compliance Control Matrix, Evidence Request List, Compliance Assessment Workbook, Gap Register, Remediation Tracker, Compliance Dashboard, and Final Compliance Assessment Report.