Audit Finding Closed ≠ Risk Resolved

A tracker may show “closed” when the owner has reported an action complete and uploaded evidence. That is useful administrative information. It does not, by itself, show whether the action addressed the exposure that led to the finding.

Start by separating three questions. Was the action implemented? Look for evidence that the agreed change took place: a configuration, revised procedure, approval record or other relevant proof. Does it operate as intended? Test the control or process after the change, using an approach proportionate to the finding and its risk. What risk remains? Record exceptions, limits of the validation and any residual exposure.

Consider a fictional approval issue. Management changes the routing rule and uploads a screenshot of the new configuration. The screenshot may support implementation. A follow-up test of subsequent transactions can assess whether requests that meet the rule now route to the authorized approver. If the test covers only a limited period or population, say so. An exception may require more work or a revised plan. A test with no exception within its scope supports a narrower conclusion than “the risk is gone.”

This distinction protects both the business and the credibility of the audit function. Management owns implementation. Internal audit follows its methodology to confirm implementation and assess whether the action addresses the exposure. Status labels should reflect what is actually evidenced. When a significant risk remains unresolved, communicate it through the appropriate governance route rather than treating a completed task as the final answer.

The five-screen video walks through status, implementation, validation, remaining risk and the decision to close. It is designed for a concise mobile view, with the reasoning carried in the visible text.

Beyond the numbers. Inside the business.