The Art of Auditing: Monitoring, Tracking, and Reporting Audit Actions

Introduction

The current focus on Corporate Governance, ESG (Environmental, Social and Governance) and Regulatory compliance means that the audit team and their objective outputs from audits are an indispensable tool for ensuring that processes are effective, risks are managed, and regulatory compliance is maintained.

But the audit itself is only half the battle; the real work begins after the audit report is issued, when the findings need to be addressed, and remedial actions need to be taken – in short, monitoring, tracking, and reporting of audit actions to ensure that business managers follow through on their commitments to improvement.

The Process of Monitoring and Tracking Audit Actions

Once an audit is completed, the findings are compiled into a report, recommendations are made and planned completion dates are agreed by management.

These recommendations often lead to specific actions that need to be taken by various departments within the organisation – “audit actions”. A typical workflow for monitoring and tracking these audit actions would be:

1. Action Assignment: Once the audit report is finalised, each recommendation is assigned to a responsible party, usually a manager or department head. This assignment is crucial as it ensures accountability.

2. Action Plan Development: The responsible party then develops a plan to address the audit finding. This plan should include specific steps, deadlines, and resources required.

3. Monitoring Progress: The audit team monitors the progress of these action plans. This may involve regular check-ins, progress reports, and updates to ensure that the completion of the agreed actions are on track.

4. Tracking Completion: As actions are completed, the responsible party provides evidence of completing the recommendation and the completion is recorded by the audit team. This tracking ensures that nothing falls through the cracks and provides a clear record of what has been accomplished.

5. Reporting: Regular reports are generated to inform senior management, the board, or audit committees about the status of audit actions. These reports often include details of actions that are overdue, at risk of not being completed on time, or have been successfully closed.

As any auditor will tell you, the reporting process may sound simple, but depending on the complexity of the reporting requirements i.e. whether detailed reporting of days open / overdue or reporting by recommendation priority, can make this process time consuming and at risk of error.

Typically, reporting of audit actions to the board / senior management within the organisation will include:

Status of Open Actions: A summary of all actions that are currently open, including their due dates, responsible parties, and current status.
  
Overdue Actions: A list of actions that have not been completed by their due date, along with an explanation of why they are overdue.

Closed Actions: A summary of actions that have been completed since the last report, including any supporting documentation that verifies completion.

Risk Assessment: An analysis of the potential risks associated with open or overdue actions, and how these risks are being mitigated.

Timeframes for Completing Audit Actions

The time required to complete audit actions can vary significantly depending on the complexity of the findings, the resources available, and the level of management support. Some studies suggest that the average time to close an audit action can range from 3 to 12 months, with more complex issues taking longer. However, organisations with robust tracking systems in place often see faster resolution times, and less “overdue” audit actions, as these systems help to maintain focus and urgency.

Tools and Technologies for Audit Action Tracking

Traditionally, audit action tracking has been a manual process, often managed through spreadsheets, emails, and periodic meetings. However, the complexity and scale of modern organisations means that the process is often resource intensive and has a significant time impact for the audit team.

The clear imperative to make this core audit process more streamlined and efficient means that the Audit Management System (AMS) providers such as AuditBoard, Teammate or K10 Vision have developed audit tracking functionality within their systems.

Such tools can significantly reduce the time and effort required to track and report on audit actions. However, such software tools typically provide a full range of audit functionality including planning tools, electronic workpapers and resourcing models and so can come at a cost that not all teams can afford.

We also speak to teams who, for various reasons, do not see value in the “full functionality” provided by such tools and instead would like to acquire a tool that focus specifically on action tracking and reporting without the additional features that drive up costs.

Is there another option?

If you want to improve your current spreadsheet process without adopting an AMS, options are limited, but don't worry—there's still hope!

A quick internet search for audit action tracking tools mostly returns AMS solutions or tools designed for non-audit tasks, like IT service tickets - non-audit tools often struggle with the complexities of audit actions, such as adjusting due dates and so are not really suitable for audit use.

However within these results, you will find Action-Tracker. Action-Tracker offers a comprehensive solution for managing audit actions. Designed and priced specifically for teams who are moving away from a “free” spreadsheet based process, it allows users to track audit recommendations, assign responsible persons, set deadlines, and monitor progress through an intuitive interface. Features include automated reminders, dashboards, and customisable reports.

In addition, Action-Tracker has been designed to segregate and track all remedial actions within the organisation whether from Internal Audit, External Audit, Compliance or perhaps your Penetration tests.

Conclusion

Monitoring, tracking, and reporting on audit actions are critical components of the audit process, but as manual processes, are resource intensive and divert the audit team from conducting additional assurance work.

By leveraging technology and exploring alternative approaches, organisations can ensure that they effectively and efficiently address audit findings, mitigate risks, and maintain compliance.

Access to the necessary technology can be expensive, although there are other options, such as Action-Tracker, that can help the organisation to turn audit findings into actionable improvements that drive organisational success.

Technology4Business is your “one stop shop” for data analytics and other technology to help audit teams. Please do get in touch if you would like to know more about Action-Tracker, or Data Analytics training, Software or Co-Sourcing.