The Follow-Up That Was Declared Closed
Eighteen months ago your unit reported on cash handling and safe custody at a Bulgarian municipal revenue office. There were six recommendations, including segregation of duties between receipting and reconciliation, and monthly surprise cash counts. Management responded with an action plan and deadlines. In the current plan, follow-up is scheduled. The revenue office sends a one-page note stating all six recommendations are 'fully implemented', signed by the head of the office. When your auditor visits, she finds: the receipting and reconciliation roles are still held by the same person on two of five days a week; surprise counts are recorded but all are dated the last working day of the month; and no supporting evidence exists for three other recommendations. The head of the office says the note was prepared by a junior clerk and he signed it without checking. The mayor's office wants the item closed before the external audit in December.
1. Evaluate the evidence supporting closure and determine the correct status for each recommendation.
Read the worked answer
A management assertion of implementation is not evidence of implementation. The only acceptable basis for closure is evidence that the recommended control now operates as intended. Here the evidence is a one-page self-declaration, unsigned by anyone who checked it, contradicted by direct observation.
Status by recommendation:
- Segregation of duties: not implemented. The same person still receipts and reconciles on two of five days. Partial coverage is not implementation of a segregation control, because the risk exists on the days the roles combine. Status: not implemented, with a note that a partial arrangement exists.
- Monthly surprise cash counts: not implemented as recommended. Counts are recorded but all fall on the last working day, which makes them predictable and removes the 'surprise' element that gives the control its value. This is a control operating in form but not in substance. Status: not implemented (or partially implemented with the design flaw described).
- Three recommendations with no supporting evidence: cannot be closed. Absence of evidence after 18 months, combined with a demonstrably unreliable management certification, means the default is 'not implemented' or 'unverified', not 'closed'.
The overall follow-up conclusion should state that management's certification was not reliable and that the underlying control environment at the revenue office has not materially improved. Record the observation evidence (dates, who was present, what was seen) in the working papers.
2. The mayor's office wants the item closed before the December external audit. How should you respond, and what should the report to the audit committee say?
Read the worked answer
Decline to close. Closing an item to improve the appearance before an external audit is precisely the pressure that the Code of Ethics requires you to resist; the status must reflect the evidence. Explain to the mayor's office, in writing, that an unsupported closure would itself be a reportable matter and would be more damaging in December than an honest open item with a credible action plan.
What to offer instead: a short, dated remediation plan with named owners, evidence requirements defined in advance (for example, a system role report showing separation for every working day, and a log of counts with irregular dates), and a re-test within 60-90 days. Offer that if the evidence is produced, the item can be closed before December on the basis of that evidence.
The committee report should cover: the follow-up result per recommendation; the finding that management certification of implementation was signed without verification, which is a control and governance issue beyond this office; the risk that other closures in the follow-up log rest on similar declarations, with a recommendation to re-verify a sample of recently closed items; and the resourcing or escalation needed if the office does not deliver. Also state plainly that the unit was asked to close the item for presentational reasons and declined, so the committee has the full picture. Follow-up is part of the audit process, and an unverified closure undermines every prior report.