Reasons Audit Findings Remain Unresolved

Our issues log was a graveyard. Nothing actually got resolved. Imagine my surprise discovering 47 aged unresolved issues in an audit department where I was the new chief auditor. The findings were documented. But nothing was resolved. Some of them had been sitting open for years. Management had been assigned ownership. But nobody had moved. My first instinct was that it was a management problem. The more I looked at it, the more I realized it was a design problem. There was no real accountability attached to any of it. There was ownership on paper. BUT No deadlines. No escalation path. No visibility for the people with authority to create pressure. The process owners had learned, correctly, that nothing happened if they waited long enough. And underneath all of it was something the profession doesn't say often enough: every one of those open findings was a documented liability. The organization knew the problem existed because audit had told them. If a loss occurred in any of those areas, the question wouldn't be whether audit did its job. It would be why the finding sat open for 18 months with no resolution. Raising issues is not the same as resolving them. The profession has spent decades improving how issues are documented and almost no time building the infrastructure to ensure they get fixed. Documentation without resolution isn't rigor. It's a very organized graveyard. How many findings in your issues log right now have not been touched in 60 days? And ask yourself this: is your issues log a resolution system or a documentation system? Most are the second one calling itself the first.

The Post-Audit CAPA Trap: Why fixing findings doesn't always fix systems The audit concludes. Findings arrive. The organization mobilizes. CAPAs are drafted. Tasks are assigned. Deadlines are set.  ... and then it repeats with the next audit. Why do organizations keep receiving similar findings despite diligently addressing each CAPA? The answer lies in a fundamental misunderstanding of what audit findings represent. They aren't isolated incidents - they're symptoms of system weaknesses. Most post-audit responses follow this pattern: 1. Create a 1:1 relationship between findings and CAPAs  2. Do not differentiate between correction, CA and PA, but: 3. Focus on immediate correction only 4. Define "effectiveness" as closing the CAPA (metrics!) 5. Treat each finding as unique rather than part of a pattern 💡 This approach creates an illusion of quality improvement while leaving system vulnerabilities intact. Consider this real example: A sponsor received findings about monitoring documentation. Their response? Retrain CRAs on documentation requirements. Six months later? Same issues, different studies. What was missing? A root cause analysis. The recognition that the monitoring process itself needed optimization - e.g., due to unrealistic timelines, insufficient review steps, and incompatible technology. Organizations that break the cycle approach findings differently - they analyse the underlying causes on a systemtic level and perform a diligent root cause analysis. • They look for patterns across seemingly unrelated findings • They trace problems to their origins in system design • They question underlying assumptions about processes • They measure effectiveness through prevention, not closure Next time you face audit findings, ask yourself these questions:  > What system allowed this to happen?  > What patterns exist across multiple findings?  > Which processes need redesign, not just correction?  > How will we know our system is truly improved? Because ... quality improvement isn't measured by corrections but by systemic improvement. What's your experience with the post-audit CAPA cycle? #QualityManagement #ClinicalResearch #InspectionReadiness 

Dear IT Auditors, Auditing IT Change Management Change is constant in IT. But uncontrolled change is one of the biggest sources of audit findings. Change management controls protect production environments from errors, downtime, and security exposures. Yet, they often fail in predictable ways. Here are some common gaps to watchout for: 📌 Missing or Incomplete Change Documentation Auditors often find changes made without proper tickets or approvals. If it isn’t documented, it didn’t happen. Lack of traceability weakens assurance. 📌 Unauthorized Changes Developers or administrators sometimes deploy fixes directly to production. Even small “emergency” changes can cause major incidents if not reviewed. 📌 Inadequate Testing Evidence Changes are approved but testing proof is missing or incomplete. Testing must confirm both functionality and security before deployment. 📌 Segregation of Duties Issues Developers who code, test, and deploy changes bypass a critical control layer. Auditors should verify that roles are properly separated to reduce risk of manipulation or error. 📌 Improper Access to Migration Tools Privileged access to deployment tools is often excessive or not reviewed. These permissions should be restricted, logged, and monitored. 📌 Weak Emergency Change Process Emergency changes are necessary but must be controlled. They need a post-implementation review to confirm they didn’t introduce new risk. 📌 Lack of Post-Change Review Auditors should check if teams validate system behavior after deployment. This confirms stability and reduces hidden risk. Change management isn’t about slowing progress. It’s about protecting reliability. When controls fail, even a single change can damage systems, trust, and the compliance posture. #ITAudit #ChangeManagement #AuditLeadership #InternalAudit #RiskManagement #GRC #ITControls #Assurance #TechGovernance #AuditQuality #CyberVerge #CyberYard

A named action owner is not the same as business ownership. One of the replies I had from a new Beyond the Lines™ subscriber this week was short and sweet, and also one of the biggest issues: “Business ownership of risk and controls.” That line could sit underneath half the frustration in internal audit. Most organisations say the business owns risk. Fewer operate like it. In practice, ownership often gets blurred. ... Management owns the process, but not the control failure. ... Risk owns the framework, but not the decision. ... Compliance owns the requirement, but not the behaviour. ... Audit owns the finding, but not the fix. And then everyone wonders why the same issues keep coming back. The problem is not always that no owner has been assigned. The problem is that ownership has been reduced to a field in a tracker. Name. Action. Due date. Status. Commentary. That can create the appearance of accountability without the mechanics of accountability. Real business ownership needs more than a name. It needs: ✅ Consequence The owner understands why the issue matters and what happens if it is not fixed. ✅ Authority The owner can change the process, resourcing, behaviour or decision rights causing the weakness. ✅ Proximity The owner is close enough to the risk to understand how it actually works in the business. ✅ Expectation Leadership expects the owner to fix the cause, not simply close the action. ✅ Follow-through The organisation tests whether the weakness has reduced, not just whether the action has been completed. Here is a simple test audit leaders can use: If audit stopped chasing this tomorrow, would management still care? If the answer is no, you may not have business ownership. You may have compliance with the audit process. That distinction matters. Because a finding can be closed without the business ever truly owning the risk. For more on where audit value leaks after the finding, download the free Internal Audit Value Leakage Map: https://lnkd.in/er_NbN-m INTEGRAL assurance #InternalAudit #AuditLeadership #RiskManagement #InternalControls #ThreeLines