From Findings to Action: How Internal Audit Can Drive Meaningful Change

Introduction

Internal audit does not create value merely by identifying control weaknesses. Its real contribution begins when assurance work helps leaders understand risk, make informed decisions and implement sustainable improvements.

An audit team may perform rigorous testing, gather sufficient evidence and produce a technically accurate report. Yet the engagement will have limited impact if management considers the findings unclear, impractical or disconnected from the organisation’s priorities.

This is the difference between reporting a problem and enabling change.

The Global Internal Audit Standards place considerable emphasis on communicating engagement results and monitoring agreed action plans. This reflects an important professional reality: completing fieldwork is not the end of an audit. Internal audit must communicate what matters, why it matters and what should happen next.

1. Begin with the risk, not the control failure

Audit findings are frequently written from the auditor’s perspective:

• A reconciliation was not completed.
• An approval was missing.
• A policy had not been updated.
• A user retained inappropriate system access.

These observations may be factually correct, but they do not automatically explain their significance to management or the board.

A stronger finding connects the control weakness to the uncertainty it creates. For example, an unreconciled account may allow errors, unauthorised transactions or inaccurate financial information to remain undetected. Excessive system access may permit an individual to initiate and conceal an inappropriate transaction.

The central question should therefore be:

What organisational objective is exposed, and what could happen if the weakness is not addressed?

This approach moves the conversation beyond procedural compliance. It helps management see the finding as a business issue involving financial integrity, operational resilience, regulatory compliance, customer confidence or strategic execution.

2. Identify the cause, not only the symptom

A recommendation will rarely produce lasting improvement if it addresses only the visible exception.

Suppose an audit identifies several overdue reconciliations. Asking employees to complete the outstanding reconciliations may resolve the immediate backlog, but it may not prevent the problem from returning.

The underlying cause could be:

• Unclear responsibility;
• Insufficient staffing;
• Inadequate supervision;
• Poorly designed systems;
• Conflicting performance priorities;
• Lack of timely information; or
• Management’s acceptance of the practice.

Effective internal audit work distinguishes between the condition and its cause. This requires discussion with process owners, analysis of recurring patterns and an understanding of how work is performed in practice.

Root-cause analysis should not become an exercise in assigning blame. Its purpose is to identify the organisational factor that must change if the risk is to be reduced sustainably.

3. Make recommendations proportionate and practical

Recommendations can lose credibility when they are too broad, too prescriptive or disproportionate to the risk.

Statements such as “management should strengthen controls” offer little direction. At the opposite extreme, internal audit may design a detailed operational solution without fully understanding its cost, technology requirements or effect on other processes.

A better approach is to establish the outcome that must be achieved while allowing management to determine the most appropriate implementation method.

For example:

Management should establish a documented review process that ensures all material reconciliations are completed, independently reviewed and escalated when overdue.

This defines the required control outcome without unnecessarily taking ownership of management’s responsibilities.

Internal audit should also consider proportionality. The cost and complexity of corrective action should correspond with the significance, likelihood and velocity of the underlying risk.

4. Develop action plans collaboratively

Collaboration does not weaken internal audit’s independence. When managed properly, it improves the quality and feasibility of corrective action.

Internal audit contributes its understanding of risk, control design and the evidence obtained during the engagement. Management contributes operational knowledge, resource awareness and responsibility for implementation.

A productive discussion should answer five questions:

1. What specific outcome must be achieved?
2. What action will address the underlying cause?
3. Who has authority and responsibility to complete it?
4. When should it be completed?
5. How will completion and effectiveness be demonstrated?

Internal audit should challenge action plans that do not adequately address the risk. However, management must retain ownership of its decisions and corrective measures.

Where management decides to accept a significant level of residual risk, that decision should be transparent and escalated through the appropriate governance process when necessary.

5. Assign one accountable owner

An action assigned to “Operations,” “Finance” or “Management” has no clearly accountable owner.

Every agreed action should identify a named role with sufficient authority to coordinate implementation. Other employees may contribute, but one person should remain accountable for the final outcome.

Clear ownership improves follow-up, reduces ambiguity and ensures that delays are escalated to the appropriate level.

The planned completion date must also be realistic. Excessively generous deadlines prolong risk exposure, while unrealistic deadlines encourage repeated extensions and weaken confidence in the follow-up process.

The deadline should reflect the severity of the risk, the complexity of implementation and any required interim controls.

6. Monitor effectiveness, not merely closure

Closing a finding because management submitted a document or confirmed completion can create false assurance.

Internal audit should distinguish between three stages:

• The action was reported as completed;
• Evidence confirms that the action was implemented; and
• Follow-up testing demonstrates that the action operates effectively.

For high-risk findings, implementation alone may be insufficient. Internal audit may need to examine a period of operation, test relevant transactions or confirm that the original exposure has reduced to an acceptable level.

Recurring findings deserve particular attention. They may indicate that previous corrective action addressed the symptom, that management oversight was ineffective or that the organisation has not allocated adequate resources to the risk.

A mature follow-up process therefore reports more than the number of open and closed findings. It considers overdue high-risk actions, repeated extensions, recurring issues, accepted risks and common themes across the organisation.

7. Communicate for decision-making

Senior management and board committees do not require every detail collected during fieldwork. They need information that supports oversight and decisions.

An effective executive communication should make five matters immediately clear:

• What happened;
• Why it happened;
• Why it matters;
• What management will do; and
• Whether the remaining risk requires leadership attention.

Concise communication is not the same as incomplete communication. It means removing unnecessary technical language while retaining the evidence, context and professional judgement needed to understand the issue.

Visual prioritisation, thematic reporting and trend analysis can also help leaders identify systemic weaknesses that may not be apparent when findings are considered individually.

Conclusion

The value of internal audit is not measured by the volume of findings issued. It is demonstrated by the quality of insight provided, the decisions influenced and the improvements sustained.

To move findings into action, internal audit must connect control weaknesses to business risk, understand their underlying causes, encourage practical responses, establish clear accountability and verify that corrective measures are effective.

A well-written audit report should do more than describe the past. It should help the organisation govern the future with greater clarity and confidence.

Professional reference

This article draws on the principles in The Institute of Internal Auditors’ Global Internal Audit Standards, particularly the requirements concerning effective communication, engagement results and monitoring action plans.