Follow-Up: 83% Complete on the Dashboard, Unverified in Fact
Eighteen months after a procurement audit, 18 action plans remain open. Nine are past their agreed due date. Management has marked three as "complete" in the tracking tool with no supporting evidence attached; one of those three is owned by the same category manager whose emergency purchases produced the original finding. The audit committee sees a dashboard showing 83% completion, because the tool counts "complete" status as closed. The CAE has 0.5 FTE of monitoring capacity and is under pressure from the CFO to "reduce follow-up overhead." The next audit committee meeting is in three weeks, and the external auditor has asked for the status of every high-rated finding.
1. How should closure be validated for the three items marked complete?
Read the worked answer
A status change is a management assertion; closure requires evidence of operating effectiveness.
Procedures, proportionate to risk: obtain the evidence behind each claim (revised policy, system configuration screenshot, approval log, sample of transactions after implementation) and re-perform a small test to confirm the control actually operated - e.g., pull ten post-implementation purchase orders and confirm the required approval exists. A policy document alone proves design, not operation.
The self-certified item needs the most scrutiny: the owner of the finding confirming his own remediation is a self-review threat. Obtain independent corroboration from procurement's second-line monitoring or from transaction testing performed by internal audit.
Outcome if unsupported: reopen the item, change the status to "open - closure not verified," and record why. Do not leave the label untouched while noting a caveat in a private memo; the tracking tool is what governance relies on.
Document the verification performed, the date, and the evidence reference - this is what the external auditor will inspect.
2. What should the audit committee see, and how do you answer the CFO's pressure to cut follow-up effort?
Read the worked answer
Dashboard redesign - present risk-weighted status, not a raw completion percentage. Show: total value at risk by rating; count and age of overdue items, split by risk rating; items claimed complete but not yet verified; and items reopened. An 83% completion figure that counts unverified claims is misleading and should be corrected before the meeting.
Prioritize rather than drop. With 0.5 FTE, apply a formal rule: verify every high-rated item; verify medium items on a sample; accept management self-certification for low-rated items where the residual risk is demonstrably minor. That is defensible risk management and can be documented as the follow-up methodology.
On the CFO's request: explain that follow-up is how internal audit determines whether its recommendations actually reduced risk - a finding closed without verification converts an audit into a suggestion box. If capacity is genuinely insufficient, the answer is to reduce the number of findings raised or to request resource, not to stop checking. Put the capacity constraint and its consequence in writing to the audit committee.
3. Which items go to the audit committee in three weeks, and in what form?
Read the worked answer
Escalate: all nine overdue items, with the rating, original due date, days overdue, owner, and management's revised date; the three unverified closures (flagged as such, with the self-certification conflict noted); and any item reopened after verification. Also report the tracking-tool accuracy issue itself, since governance has been receiving a metric that overstates progress.
Form: a concise follow-up report - a table plus a short narrative of no more than a page on the two or three most significant exposures, including the category manager's unremediated authority. Name accountable executives, not just departments, and state explicitly that internal audit has not verified the closures.
Also respond to the external auditor's request with the same information, marked as internal audit's assessment, and note which items are unverified so they do not over-rely on the completion percentages.
Tone: constructive - credit genuine progress, frame escalation as risk exposure that needs a decision (accept, remediate, or extend), not as a compliance failure.