An audit finding becomes easier to resolve when the institution can explain what failed, what changed and how someone independent checked the result. A useful closure record connects these three questions to specific evidence. It also preserves the original deadline and shows what still requires attention. This worked example follows a credit exception finding through management action and independent review at a fictional NBFC.
The same record structure can support a bank, although the institution must determine its own applicable requirements, audit methodology and approval authority. Basel Committee guidance provides banking context for management accountability and internal audit follow-up. The IIA’s guidance also discusses monitoring recommendations and action plans. Neither source prescribes the fictional sample, dates or template used here. [1][2]
The finding and its boundary
Illustrative Finance Ltd is an invented NBFC. On 3 August 2026, its internal audit team records finding AR-026-014 after examining 60 credit exception files. Twelve files lack retained evidence of the independent review required by the company’s own Credit Exceptions Procedure v1. The reviewers record the relevant period, selection method, affected teams and repository references so another auditor can understand the boundary of the observation.
The finding is about an incomplete approval trail. Missing evidence does not establish, by itself, that a review never happened. Equally, an owner’s recollection does not establish that the required review occurred. The audit team separates what it observed from what it inferred and asks management to investigate the gap. The fictional institution classifies the finding as High under its internal rating scale. That label is not a universal regulatory classification.
Turn the observation into an actionable cause
Management traces the problem to the exception queue. The queue allows an item to be marked complete without a linked review record. It also lacks a substitute reviewer when the usual reviewer is absent. These explanations are supported by a walkthrough and selected queue histories; they are recorded as the working cause rather than asserted merely because they sound plausible.
The agreed action is specific: introduce reviewer assignment, absence cover and a mandatory evidence link, then reconcile the queue to the complete population of exceptions. “Train the team” alone would not address the workflow weakness. Training may support the change, but the action should identify the actual control to be introduced, who operates it, when it operates and how its performance will be evidenced.
Agree ownership and the original deadline
The credit operations lead owns the corrective action. Internal audit owns the independent follow-up assessment under the institution’s audit methodology. The authorised closure decision sits with the designated reviewer or approver under that methodology. The roles are recorded before implementation so that preparing evidence and accepting evidence are distinguishable responsibilities.
The original due date is 15 September 2026. Management reports that the revised process was introduced on 10 September. No extension has been approved. The register retains the original date even if management later requests more time. An approved revised deadline, its reason and approval reference should be recorded separately. Changing a date should not erase the history of delay, and completing management’s action should not automatically close the finding.
Assemble evidence that supports a defined claim
The evidence pack begins with a short inventory. EV-01 is the revised procedure and approved queue design. EV-02 reconciles 240 exception records from 11–24 September to the queue. EV-03 is the independent test sheet for 60 selected records. EV-04 is management’s note describing corrections made on 25 September. These identifiers are fictional; in practice they should resolve to controlled, retrievable files.
Each item should answer a question. The revised procedure supports what the control is designed to do. The population reconciliation supports completeness of the dataset used for testing. The test sheet supports how selected transactions operated. The management note describes a response to exceptions. None of these documents should be silently substituted for another. A policy document cannot, on its own, demonstrate consistent operation.
Capture the exact file version, relevant period and repository location. Avoid a link that always opens the latest version if it makes the reviewed version unrecoverable. Access should allow the authorised reviewer to inspect the evidence while respecting the institution’s confidentiality controls. The public toolkit needs reference labels, not customer records or actual audit working papers.
Design a proportionate independent test
The reviewer first checks whether the 240-record population is complete against the source used by the institution. A sample selected from an incomplete queue could miss the very transactions that bypassed the process. The reviewer then selects 60 records across teams and dates, including absence-cover cases, and records why that approach is appropriate for this fictional exercise.
For each selected item, the reviewer examines whether the assigned person had the relevant authority, whether the review occurred at the required point, whether preparer and reviewer responsibilities were appropriately separated, and whether the evidence can be retrieved. The criteria come from the fictional internal procedure. Real testing should reflect the actual finding, control frequency, risks and approved audit methodology.
Sixty records is an illustrative selection, not a recommended minimum or statistical assurance level. The exercise does not support projecting the results to the entire portfolio. A useful working paper explains its selection rationale and limitations rather than presenting a round sample size as sufficient by itself.
Interpret the result before making a decision
Of the 60 selected records, 57 meet the stated criteria. Three have no retrievable independent-review record. The observed exception rate is three divided by sixty, or 5%. This is a description of the tested sample. It does not show that 5% of the full portfolio is defective, nor does it establish an acceptable tolerance.
Management says the three records were corrected on 25 September. That is relevant evidence of action, but the reviewer still needs to consider whether the correction addresses the cause, whether other records could be affected and whether the revised process now operates as intended. A follow-up test should be designed around those questions. It should not simply repeat the owner’s assertion in a closure field.
On 29 September the reviewer returns the closure request. The decision explains the unresolved exceptions, cites the evidence inventory and identifies the additional work required. The finding remains open. The language is factual and specific, allowing management to respond to a defined gap without guessing why the request was rejected.
| Test outcome | Records | Interpretation |
|---|---|---|
| Met stated criteria | 57 | Evidence available for the selected criteria |
| Missing review evidence | 3 | Further investigation and independent retest |
| Total selected | 60 | Illustrative selection, not a sampling standard |
Keep the register and evidence pack consistent
As of 30 September, AR-026-014 is 15 calendar days beyond its original due date. The register records Returned as the workflow status and leaves the closure date blank. The next action is to provide further queue evidence and complete an independent retest. Where a revised deadline is authorised later, the record should retain both dates and the decision that changed the current expectation.
The accompanying workbook includes two additional fictional findings to demonstrate different states. A vendor review finding due on 5 October is in progress and not overdue at the reporting date. A policy-register finding has an approved closure dated 28 September. These rows help users see how the tracker responds to an open future obligation and a completed review without treating every populated row as closed.
The workbook flags missing dates and incomplete closure fields. It also highlights duplicate identifiers and an identical owner and reviewer entry. These are administrative checks. “Record populated” means that specified fields are present; it does not establish independence in substance or the sufficiency of the evidence. Those judgements remain part of the review.
| Finding | Position at 30 Sep 2026 | Next step |
|---|---|---|
| AR-026-014 · Credit exceptions | Returned · 15 days overdue | Obtain evidence and retest |
| AR-026-015 · Vendor review | In progress · due 5 Oct | Complete assessment |
| AR-026-016 · Policy register | Closed · 28 Sep | Monitor next review |
Report decisions and residual work clearly
A management summary should distinguish implementation progress, review progress and final closure. For this example, a useful update is that management introduced a new queue, independent testing found three exceptions, and further verification is outstanding. Reporting the item simply as “implemented” would leave the audience without the information needed to understand the remaining work.
Explain significant overdue findings, agreed next steps and accountable owners. If management proposes accepting residual risk, use the institution’s applicable authorisation and escalation process. Record the rationale, authority, conditions and next review date. Risk acceptance should not be relabelled as successful remediation automatically. The original observation and supporting history should remain available for later challenge.
Use the toolkit in your own workflow
Start with the blank Register sheet and set its as-of date. Add one row per finding using stable identifiers. Populate original deadlines, current status and accountable owners. Use the Word closure pack for the fuller observation, cause, action, evidence inventory, test results and decision. The completed example shows why a carefully documented review can correctly end in a returned request.
Before using a summary, investigate any date or closure flags. Store successive versions under the institution’s document controls. Extend the prepared workbook ranges deliberately when adding more records; the instructions explain which formulas and validation ranges need to grow. Do not treat a downloaded spreadsheet as an access-controlled case-management system.
The practical objective is a record that another authorised person can follow: an identifiable finding, a relevant corrective action, retrievable evidence, a reasoned independent conclusion and an accountable next step. The free toolkit and worked example are starting points for adapting that process to the institution’s own responsibilities.
PRIMARY REFERENCES
Sources & further reading
Primary-source references checked on 12 October 2026. Follow the relevant authority’s current text for applicability, amendments and commencement dates. International standards provide context and are not automatically identical to domestic requirements.