How Does an Audit Finding Actually Close?

In most organisations closing an audit finding ends with an email exchange: the action has been taken, screenshot attached. When the same finding returns the following year, everyone is surprised. This article is about what evidence of a genuinely closed finding looks like.

Why the Same Finding Returns Next Year

Closing a finding usually means one of three things: writing a procedure, running a training session, or changing a setting. All three are real actions, and all three share one weakness: they produce no record of continuity.

The procedure was written, but is it followed? The training was given, but did behaviour change? The setting was changed, but is it still at that value? Without answers to those three the finding is not closed; its closure has merely been asserted.

When the auditor looks at the same place the following period, they look for the record rather than the assertion. With no record the finding is reopened, this time as a repeat finding with a heavier rating.

Three Levels of Closure Evidence

The strength of evidence can be thought of in levels, and the level auditors accept is usually the third.

Why the second level falls short matters. A screenshot shows the control is on today. The audit period is in the past, and the image says nothing about whether the control was on then. What the auditor needs is a record showing it was on in the past too.

What Shows It Operates: The Refusals

The strongest evidence that a control operates is the refusals it produced. If a gate has never turned anyone away, there is no way to know whether it is locked.

This is the most useful kind of evidence in an audit and the one organisations think about least. The examples are concrete.

• Blocked segregation of duties attempts. Someone trying to approve their own request and being refused proves the rule is enforced. Those attempts have to be recorded separately; a system that records only successful operations cannot show it.
• Rejected change requests. A rejection recorded with its reason shows the approval step is a control rather than a logging step.
• Scripts blocked from being saved. A rule blocking a save shows the rule catalogue is not decorative.
• Rejected settings changes. This is the only record showing four eyes actually operates.

All of those being zero is also information and deserves an honest reading. Zero refusals means either the control never fired or that everyone found another route when it did. Both are worth looking into.

When the Control Came Into Force

The field most often skipped when closing a finding is the date. The control was switched on, but when? That date decides where it falls inside the audit period and defines the scope of the closure.

A control switched on mid period produces no evidence for the first half. Rather than hiding that, state it: the control came into force on this date, and the compensating control for the earlier part is this. An auditor accepts that sentence; what they do not accept is leaving the date vague.

Showing the date requires settings changes to be recorded. Without a settings history, the only source for when a control was switched on is somebody's recollection, and that is not evidence.

What Belongs in a Closure File

A file prepared to close a finding can be short, but it should carry these five items.

• The definition of the control. What was done, on which screen, as which rule or policy. Not a general sentence but a definition with a counterpart in the system.
• The date it came into force. Taken from the settings change record, with the person and the approval behind it visible.
• Evidence of operation. How many times the control fired since that date and the refusals it produced.
• One worked example. The evidence file of a single request where the control actually fired. One case is more convincing than ten pages of explanation.
• The residual risk. The cases the control does not cover. Writing it yourself is better than the auditor finding it and it strengthens the credibility of the closure.

Those five items take minutes to assemble when evidence comes from the work itself. Gathered by hand they take days, which is also the explanation for why closing findings gets postponed.

Frequently Asked Questions

How many examples are needed to close a finding?

Quality decides, not quantity. A single case where the control actually fired is stronger evidence than a hundred where it never did. The most convincing combination is a count of how often the control fired across the period plus the full evidence file for one of those occasions.

When is a compensating control accepted?

When the reason the primary control cannot be applied is written down and the compensating control itself produces evidence. Incomplete segregation of duties in small teams is common and acceptable; what is not acceptable is a compensating control that is also just an assertion. Delivering anchors outside on a schedule, for instance, is a working compensating control where the separation between record keeper and record verifier cannot be achieved.

Why is a repeat finding rated more heavily?

Because appearing a second time shows not only a missing control but a remediation process that does not work either. Management committed to an action, the action appeared complete, and the outcome did not change. That is a wider problem than a single control gap and the report treats it as such.

Is writing down what the control does not cover risky?

The opposite: it strengthens the closure. A file where everything looks flawless raises suspicion and invites a deeper look. Writing the residual risk yourself moves the discussion from whether the control is sufficient to whether the residual risk is acceptable, and the second is a question management can decide.