Closing High-Risk Findings on a Promise
A regional bank's internal audit completed a branch audit and rated it 'needs improvement' with 14 findings, including four high-risk: unapproved wire transfers, shared teller credentials, missing dual control on vault, and stale customer due-diligence files. Management's response lists one owner-the branch manager-and a target date of 'Q3' for all 14 items, with no interim milestones. The audit committee packet includes only the overall rating and says 'management has agreed to remediate.' Six months later, the CAE's follow-up shows 3 of 14 closed; the four high-risk items remain open, and the branch manager has been promoted. The chief risk officer asks internal audit to close the remaining items 'based on management's commitment' because reopening the report will complicate the promotion. The audit committee meets next week.
1. Evaluate management's responses and the CAE's follow-up. Were the findings appropriately tracked and closed?
Read the worked answer
The management responses are not adequate for high-risk findings. One owner and a broad 'Q3' date for all 14 items provide no actionable plan, no interim milestones, and no evidence of remediation. High-risk findings such as unapproved wire transfers and shared teller credentials require specific actions, named owners, dates, and validation criteria. A branch manager may be accountable for the branch, but some actions require technology, operations, or compliance owners outside the branch.
The audit committee reporting was too thin. Sending only the overall rating and the statement that management 'agreed to remediate' conceals the nature and severity of the high-risk findings. The committee needs the findings, risk ratings, management responses, and the CAE's assessment of whether the responses are adequate.
Follow-up was not risk-based. Six months after the report, only 3 of 14 items are closed and all four high-risk items remain open. That should have triggered escalation well before the next audit committee meeting, not a last-minute decision. High-risk findings should have shorter follow-up intervals and interim status reporting. The branch manager's promotion does not close the findings and may increase the risk that ownership is diffused.
The findings were not appropriately closed. Closing requires evidence that the action was implemented and that the risk is addressed. Three closures may be valid if verified, but the remaining items are open. The CAE should not treat management commitment as equivalent to remediation.
2. What should the CAE report to the audit committee next week, and how should the CAE respond to the CRO's request to close items based on commitment?
Read the worked answer
Report the current status clearly. The CAE should present each high-risk finding, its original risk rating, management's response, current closure status, the evidence obtained, and the residual risk. The report should explain that only 3 of 14 items are closed and that all four high-risk items remain open. It should identify who is now accountable, given the branch manager's promotion, and what interim milestones are missing.
Do not close on commitment. Management's intention to remediate is not evidence of implementation. Closing findings without verification would misstate the control environment to the audit committee and could mislead regulators or external auditors. The CAE should tell the CRO that closure requires evidence and that the audit committee must be informed of the open high-risk items. If management wants to accept the residual risk, that acceptance should be documented at the appropriate level and reported to the audit committee; it is not the CAE's decision to make silently.
Handle the pressure professionally. The CAE should acknowledge the CRO's concern about the promotion but separate it from the audit judgment. The promotion is an HR matter; the audit findings are a control matter. The CAE should document the CRO's request and the reasons for declining it. If the CRO persists, the CAE should escalate to the audit committee chair, consistent with functional reporting.
Recommendation. The audit committee should require a remediation plan for the four high-risk items with owners, dates, interim milestones, and evidence, and should receive monthly updates until closure. Internal audit should validate implementation before closing each item.
3. Recommend improvements to the follow-up and communication process to prevent recurrence, including how to handle management changes and risk acceptance.
Read the worked answer
Build a risk-based issue-tracking process. Each finding should have a risk rating, root cause, action plan, accountable owner, target date, interim milestones for high-risk items, and defined evidence of closure. The CAE should review and challenge responses that are vague or assign all actions to one person. High-risk findings should be followed up more frequently-perhaps monthly-and escalated when milestones are missed.
Verify closure. Closure should require testing or inspection by internal audit, not a management assertion. The evidence should be retained and reviewed by a supervisor. If management accepts the risk instead of remediating, the acceptance should be documented by the appropriate authority, with the residual risk explained to the audit committee.
Communicate continuously. The audit committee should receive a dashboard of open findings by risk rating, aging, owner, and status, not just an overall engagement rating. Significant high-risk findings should be reported as they arise, not held for the next scheduled meeting. Management changes should trigger a handover of open findings and a confirmation of the new owner; a promotion or transfer should not reset the clock.
Protect objectivity. The CAE should not allow operational pressure, including concern about a manager's promotion, to affect closure decisions. Requests to close findings without evidence should be documented and escalated. The QAIP should periodically review follow-up files to confirm that closures are supported. Finally, the CAE should report the root cause of the recurrence-weak response quality and insufficient follow-up-so the audit committee can address the governance gap, not just the individual findings.