Closing the Audit Loop: A Methodology for Tracking Audit Recommendations

Author: Guy McClain, PhD., Associate Professor of Auditing, Else School of Management, Millsaps College, USA(1)

Introduction

Audits performed by Supreme Audit Institutions (SAIs) are valuable tools that help identify risks, inefficiencies and areas of improvement for a wide variety of governmental programs.  These audits fill the gap between policy and practice by providing timely audit results and constructive feedback to those audited.  Included in this constructive feedback are recommendations meant to enhance performance and implementation of recommendations to ensure policy and/or standards are being met. This closing of the audit loop is an essential, final step in the audit process.  

Closing of the audit loop, however, can be less effective if SAIs do not track the implementation status of audit recommendations.(2)  In fact, the INTOSAI P-12: The Value and Benefits of Supreme Audit Institutions, highlights the importance of tracking (principle 1) and reporting (principle 3) audit recommendations(3).  Tracking and reporting increase public confidence by providing transparency into the work performed by SAIs.  Additionally, tracking information can be used internally by SAIs to benchmark performance furthering their own quality control efforts. 

A recent survey conducted by the INTOSAI Working Group on Evaluation of Public Policies and Programs found that 72% of respondents tracked the implementation of audit recommendations, while only 45% of respondents published information about the implemented recommendations.  Thus, recommendation tracking is generally performed, but the results are not typically shared.  This lack of transparency is troubling since there is a growing body of academic research that shows the positive effect implementation disclosure has on public opinion of local governments(4) and public services(5).

A Methodology for Tracking Audit Recommendations

Creating a methodology for tracking the implementation of audit recommendations can enhance transparency with the public and improve internal SAI quality control.  The steps below are general guidelines as each SAI will have unique circumstances and challenges.  These guidelines can act as a starting point to craft a method that works for SAIs and their constituencies.

Step 1: Explain the Audit Recommendations

SAIs are in a position to possess relevant information that program directors and other auditees may not have.  This siloed approach to government bureaucracy may create misunderstandings between SAIs and the auditee.  Thus, it is crucial that SAIs explain audit recommendations in detail.  Involving the auditee in discussions and diving into the data will help to ensure they fully comprehend the underlying issues.

The goal is for the auditee to acknowledge the recommendations are important and within their control to implement.  On the other hand, the auditees may also challenge the recommendations.  The SAI, therefore, should be prepared to respond properly by providing more evidence or making an adjustment.  This negotiation process will take time, but if SAIs eliminate the auditee’s challenges and counter points to the recommendations, altogether the resolution of the deficiency may be delayed or inadequate as there is not an open dialogue between SAIs and auditees to fully understand the audit recommendations.

Step 2: Prioritize Recommendations and Identify Timeframes for Implementation

Different sources of findings hold distinct value.  Program evaluations and performance reviews are key tools for SAI program management, but differ in many ways.  For example, program evaluation may use qualitative data, whereas performance reviews will use strictly quantitative data.  Regardless, SAIs can prioritize recommendations based on risk factors like potential impact, alignment to auditee strategic objectives and cost of mitigation.   

SAIs could also prioritize recommendations by different timelines required for auditee implementation.  The importance of timelines cannot be overstated.  Choosing the right interval for the timeline can be a delicate balance.  The longer the interval the more likely it is that information gets forgotten.  Extremely short timelines tend to trivialize the issue as serious recommendations may take substantial time to correct.  Regardless, if a SAI has the ability within their mandate to vary implementation requirement timelines, there should be a source of clear communication with the auditee that encourages accountability.  While you do want to collaborate with the auditee in the process (see step 1), timelines communicate the auditee’s responsibility for correcting the audit recommendations.

If it is within the SAI’s mandate and scope of responsibilities, action plans can help ensure the implementation of recommendations.  Once SAIs have prioritized their recommendations, they could ensure that auditees have developed clear and detailed action plans in conjunction and agreement with the SAI to address each issue.  This action plan should include specific steps, responsibilities, resources and timelines.

Step 3: Do Not Become Beholden to Technology

Technological tools can significantly enhance tracking efforts.  Automated case management systems can help the SAI manage multiple audits and their recommendations.  This process automation, however, may only be accessible to SAIs with large budgets and sizeable workforces.  

Tracking audit recommendations is not about choosing the right software.  Effective tracking is about maintaining accountability and clear expectations, which can be done using little technology.  An effective tracking system can be created using minimal technology like a word processor, spreadsheets, email and a filing system.

Step 4: Monitor Progress Through a Culture of Continuous Improvement

SAIs can make the most of their audit recommendations by creating a culture of continuous improvement.  This culture is the process of acquiring, creating, sharing and applying knowledge to improve the performance of the auditee.  SAIs should encourage the auditee to see the recommendations as opportunities for learning and growth rather than criticisms or failures.  This cultural shift can help ensure that audit recommendations are addressed proactively and effectively.

The creation of this culture requires a systematic effort.  It can be facilitated by defining audit objectives, audit indicators and measures of progress.  SAIs should tailor the content and style of communication to the needs and preferences of the auditee.  The goal is to encourage the auditee to take responsibility for the audit recommendations.

Regular monitoring is essential to ensure the auditee is effectively implementing recommendations.  This process involves tracking progress and the auditee’s actions, reviewing the effectiveness of implemented changes, and identifying any gaps or additional actions needed to meet recommendations, as needed.  This step should not be confused with follow-up audits that SAIs may be required to perform.  This step is more about checking-in with the auditee to assess progress and lend support.

Conclusion

Audit recommendations identify risks to the successful delivery of outcomes consistent with policy and legislative requirements, and highlight actions aimed at addressing those risks, and opportunities for improvement.  By using this four-step guide, SAIs can transform their audit recommendations from a challenge into an opportunity, driving improvement, enhancing risk management, and adding value to the government programs under audit.