The Follow-Up That Didn't Happen
You are the chief audit executive of a hospital group. Twelve months ago, your team issued a high-priority finding: the pharmacy's controlled-substance reconciliation was not performed daily, creating a diversion risk. Management agreed to a remediation plan with a 90-day deadline. At the 90-day mark, management reported 'implemented.' Your follow-up procedure consisted of an email from the pharmacy manager stating 'we now reconcile daily.' You closed the finding. Now, a year later, an internal tip alleges diversion, and a preliminary review shows reconciliation logs are missing for 40% of days over the past six months. The audit committee is asking how this was missed.
1. Diagnose the failure in the follow-up process and identify which audit standards or principles were breached.
Read the worked answer
The failure is a verification failure: the finding was closed on the basis of management's self-report, with no independent evidence.
Breaches of principle:
- Sufficiency of evidence: an email assertion is not evidence that a control operates. Follow-up must obtain evidence of actual operation, not of intent or claim. The auditor accepted a representation as proof.
- Risk-based follow-up: a high-priority finding on controlled substances warranted the strongest verification, not the weakest. The follow-up effort was inversely proportional to the risk.
- Closure criteria: 'implemented' should require evidence the control is designed and operating - e.g., a sample of reconciliation logs showing daily completion, not a statement that it happens.
Root cause: the follow-up procedure was designed as an administrative checkbox rather than a test of control operation. The 40% missing logs over six months suggest the control may never have operated reliably - and the email may have been aspirational or inaccurate.
2. Design a corrected follow-up procedure for high-priority findings and explain how it would have caught this.
Read the worked answer
Corrected procedure for high-priority findings:
- Define closure criteria up front - specify the evidence that will demonstrate implementation (e.g., 'daily reconciliation logs for a 30-day sample, reviewed and signed').
- Obtain independent evidence of operation - sample the actual logs, system records, or reconciliations. Do not accept management assertions alone.
- Test over time - for a daily control, sample across a period (e.g., 20–30 days) to detect intermittent failure, not a single day's evidence.
- Verify with a second source where possible - e.g., system-generated timestamps vs. manual logs.
- Require sign-off by the CAE before closing a high-priority finding, with the evidence attached to the follow-up file.
- Set a re-test at a defined interval after closure to confirm sustainability.
How it would have caught this: sampling 20–30 days of logs at the 90-day mark would have revealed missing days immediately, before the finding was closed. The control would have remained open, and the diversion risk would have stayed visible to the audit committee.
3. The audit committee asks how this was missed. Draft the core of your response, including accountability and remediation.
Read the worked answer
Core response (honest, specific, non-defensive):
'The finding was closed on the basis of a management email rather than independent evidence of the control's operation. Our follow-up procedure for high-priority findings did not require sampling of the reconciliation logs, and I signed off on closure without that evidence. That was a failure of verification, and I take responsibility for it.'
Accountability:
- Name the process failure, not just the outcome. The procedure was inadequate and the closure decision applied it without challenge.
- Avoid blaming the pharmacy manager alone - management's self-report was one input; the audit's job was to test it.
Remediation:
- Reopen the finding and conduct an immediate independent review of reconciliation logs and diversion indicators.
- Implement the corrected follow-up procedure (closure criteria, independent evidence, CAE sign-off, re-test) for all high-priority findings.
- Retrospectively review other findings closed on self-report to identify similar exposure.
- Report progress to the audit committee at each meeting until closed.
Tone: the committee needs candor and a credible fix, not reassurance. The credibility of the audit function depends on owning the miss.