The Clean Follow-Up Report
A payroll audit at a 2,500-employee logistics company found that 8% of sampled timesheets for night-shift drivers were approved after payroll ran, and that supervisors can edit time entries after approval with no audit trail. You reported this as a 'high' finding with three recommendations. Six months later, the payroll manager has implemented one recommendation, says the edit-trail fix needs a system upgrade budgeted for next year, and the HR director has signed a memo 'accepting the residual risk.' The audit committee receives your follow-up report next week; the CAE is new and wants to close the finding to keep the report clean.
1. Can the finding be closed? How should follow-up be handled?
Read the worked answer
No - not on these facts. One of three recommendations implemented, one blocked pending a budgeted upgrade, and one unaddressed is partially implemented, which means the risk remains. Follow-up status should distinguish implemented, partially implemented, not implemented, and risk accepted; this is a partial.
Follow-up handling:
- Verify that the implemented recommendation actually works. Test it; do not accept the payroll manager's description.
- Set a dated milestone for the system upgrade and identify interim compensating controls: an exception report of post-approval edits reviewed by someone independent of payroll, and supervisor sign-off before the next payroll run.
- Re-perform the original test on a new sample to see whether the 8% late-approval rate has changed. The status of the finding depends on whether the condition still exists, not on whether a memo was signed.
- Report the residual risk and the acceptance in the follow-up report.
The CAE's desire for a clean report is not a reason to change the status. Closing an open risk to improve appearance is a reporting-integrity issue and would mislead the committee about the control environment.
2. Who is authorized to accept the residual risk, and what should internal audit do if acceptance is at the wrong level?
Read the worked answer
Risk acceptance must be made by the level of management with authority over the risk and the resources to address it - typically the process owner's senior executive and, for significant risks, the board or audit committee. Ask:
- Does the HR director own the payroll control process? Usually not. Payroll typically sits within finance or HR operations, and the HR director may not control the system budget or the supervisors' behavior.
- Is the risk significant enough that the board should decide? Late timesheet approval and an untraceable edit capability affect pay accuracy and fraud risk across 2,500 employees; that is likely a board-level acceptance.
- Is the acceptance informed? A memo stating 'we accept the residual risk' without the exposure, the compensating controls, or a remediation date is not an informed acceptance.
If acceptance is at the wrong level, internal audit escalates: report to the CEO and audit committee that the risk was accepted below the appropriate level, state the residual risk, and ask the committee to either formally accept it or direct remediation. The CAE should not record the memo as closure.
3. How should the follow-up report be worded? Draft the essence.
Read the worked answer
The report should be accurate, specific, and neutral - status first, then evidence, then the decision required.
Essence:
- Status: 1 of 3 recommendations implemented; 2 open (one pending the system upgrade, one not started). Finding remains open.
- Verified condition: re-testing of 40 timesheets found 10% approved after payroll ran, versus 8% originally - the condition has not improved.
- Compensating control: none in place at the time of follow-up; an interim exception report is proposed to begin on a stated date.
- Risk acceptance: HR director memo dated [date], covering a risk that director does not own; the committee is asked either to formally accept the residual risk or to direct a remediation date.
- Milestone: system upgrade budgeted for next year; internal audit will re-test after implementation.
Avoid 'management has accepted the risk, finding closed.' The committee needs to see the residual risk and make its own decision. The report should make the choice explicit rather than resolving it for them.