Following up on recommendations

The audit report is delivered: 14 recommendations, and management said "good, we'll look at them". Six months later a second review found that 9 of the 14 were unchanged. Nobody hid anything: ordinary daily work simply pushed the recommendations aside, and no one asked whether they were done. Follow-up, tracking the delivery of recommendations, is the second half of an audit: without it the report becomes history while the work stays as it was.

The tracking table

The simplest tool is one table, in Excel or a shared document. The columns: serial number, finding, significance, recommendation, owner, deadline, status, evidence and comment. Keep four or five statuses: open, in progress, implemented, closed, overdue. "Implemented" and "closed" are not the same: the owner writes "implemented", while "closed" is set when the auditor or an independent manager has seen the evidence.

An example: a five-branch cosmetics chain

At the chain, the audit gave 14 recommendations: 3 of high significance, 6 medium and 5 low. The three high ones were: add a second approval to stock adjustments (30 days), a locked shelf for expensive perfumes (45 days) and set up a write-off committee (30 days). An owner and a deadline were written against each, and checkpoints were set at day 30, 60 and 90.

At day 30 the review found two recommendations marked "implemented". The auditor picked several documents from the last month at each branch: the second approval works in three branches and is still absent in two. The status changed from "implemented" to "partial" and was not closed. Without the table this difference would have gone unnoticed.

At day 60 it emerged that the committee for the third recommendation had been set up, but every write-off act still carried a single signature. The owner's deadline was extended by 15 days, and the reason and new date were entered in the table.

What evidence to take on re-testing

The word "done" is not evidence. The type of evidence depends on the recommendation:

1. A procedure or order: a copy of the new document and a sheet of staff signatures confirming they have read it.
2. A system setting: a screen of access rights, a table of roles, an exported log.
3. Practice: a sample of documents from the last 30 days.
4. Observation: watching the process once on site and, if needed, a count.

An important condition: the new routine should have run for at least a month or two. A routine hastily created for the auditor's arrival will not pass the test.

Rules: deadlines, declining and the tracker

Not every recommendation is done on time, so rules are needed:

• An extension is made in writing with the reason and a new date, and is approved by the owner's manager. A recommendation extended more than twice is raised in significance.
• If management decides not to act on a recommendation, that is recorded too: "Risk understood and accepted". The recommendation then does not vanish silently.
• A 30-day delay goes to the owner's manager, a 60-day delay to the director or owner.

Who tracks, and how often

Without a tracker the table dies. Appoint one person: an internal control specialist, the director's assistant or an external auditor. Once a month they update the statuses, and once a week in a short 15-minute meeting they go through only what is overdue. One page a month is enough for the director: how many are closed, how many are overdue and why.

The measure and common mistakes

A follow-up report is made of simple figures: how many recommendations are closed, how many in progress, how many overdue and which findings recurred. In our example, 9 of 14 are closed (64%), 3 are in progress and 2 are overdue. These figures show where to look harder in the next review. The share of recurring findings is shown separately: if it does not fall, the problem lies not in the recommendation but in its delivery.

Common mistakes

• Starting everything at once: if 14 recommendations are launched together, none gets finished. Close the three high-significance ones first.
• Naming "the warehouse" or "accounts" as the owner: give the task to a named person, not a department.
• A deadline such as "as soon as possible": write a specific date.
• Not measuring the result: even once control over stock adjustments is in place, check at the next count whether the shortage has fallen.

Conclusion

A recommendation brings no benefit until it is carried out. Where there is an owner, a deadline, evidence and independent confirmation, a report turns into work. OmborAudit hands over a recommendations plan with priorities, owners and deadlines and, if you wish, re-checks delivery at the agreed date.