Every audit team knows the feeling. The report was issued, management agreed to every recommendation, and twelve months later the same findings appear again in the next review. The audit added insight but not change. Tracking recommendations through to closure is where internal audit proves its value, and it is also where many teams in Zimbabwe and across Africa are weakest, especially when follow-up lives in a spreadsheet that one person maintains.
This article sets out a practical, step-by-step approach to tracking audit recommendations, a simple tracker template you can adopt today, and the mistakes that most often leave findings open long after their due dates.
Why follow-up is a professional requirement, not an extra
The IIA’s Global Internal Audit Standards, effective from 9 January 2025, address follow-up directly. Standard 15.2, Confirming the Implementation of Recommendations or Action Plans, expects internal auditors to confirm that management has implemented the agreed recommendations or action plans, following an established methodology. Where management has not acted, the expectation is that the matter is escalated appropriately. In practice this means the chief audit executive needs a defined process, not good intentions.
External auditors have a parallel obligation. Under ISA 265, deficiencies in internal control are communicated to management and those charged with governance, and the auditor will naturally consider in the following year whether previously reported deficiencies have been addressed. For banks supervised by the Reserve Bank of Zimbabwe, public entities reporting to boards and line ministries, and NGOs answerable to donors, unresolved findings carried from year to year send a clear governance signal, and rarely a good one.
A step-by-step approach to tracking recommendations
Step 1: Agree actions that can actually be tracked
Tracking starts at the exit meeting, not after the report is issued. For each finding, agree with management a specific action, a named owner (a person, not a department), a realistic target date, and what evidence will demonstrate completion. “Management will strengthen controls” cannot be tracked. “The Finance Manager will introduce a monthly bank reconciliation reviewed and signed by the Financial Controller by 31 January” can.
Step 2: Rate each finding
Assign a risk rating (for example High, Medium, Low) at reporting stage. The rating drives follow-up frequency, the level of evidence you require, and what gets escalated to the audit committee. High-rated findings deserve shorter deadlines and closer attention.
Step 3: Record everything in one central tracker
Each finding should have a unique reference that links back to the audit report and working papers. One register for the whole organisation, not one per auditor, makes it possible to report trends by department, by audit type and by age.
Step 4: Request updates on a set cycle
Ask action owners for status updates monthly or quarterly, ahead of each audit committee meeting. Ask for evidence with the update, not just a narrative. A self-reported “completed” is a claim, not a confirmation.
Step 5: Validate before closing
Internal audit, not management, decides when a finding is closed. Match the depth of validation to the risk: a low-rated item may be closed on documentary evidence, while a high-rated control failure may need re-performance or a small sample test to confirm the new control actually operates.
Step 6: Escalate overdue and revised items
Define escalation rules in advance. For example: overdue by 30 days goes to the head of the department; overdue by 90 days, or any repeated date extension on a high-rated finding, goes to the executive and the audit committee. Where senior management chooses not to act, the decision should be documented as an accepted risk, approved at the right level.
Step 7: Report to the audit committee
Give the committee a short, consistent view: number of open findings by rating, overdue items, ageing, findings closed this period, and repeat findings. Trends over several quarters tell the committee far more than a long list of individual items.
A simple recommendation tracker template
Whatever tool you use, these are the fields that make tracking work:
| Ref | Audit / finding | Rating | Agreed action | Owner | Due date | Status | Evidence / validation |
|---|---|---|---|---|---|---|---|
| PR-2026-03 | Payroll: terminated staff still on payroll | High | HR to notify Payroll of exits within 2 days via signed exit form | HR Manager | 30 Nov 2026 | In progress | Pending: sample of 10 exits to be tested |
| PROC-2026-07 | Procurement: contracts awarded without three quotations | Medium | Update procurement checklist; Procurement Committee to reject incomplete files | Procurement Manager | 31 Oct 2026 | Implemented (unvalidated) | Updated checklist received; awaiting file review |
| IT-2026-02 | IT: no periodic user access review | Medium | Quarterly access review signed off by system owners | IT Manager | 30 Sep 2026 | Overdue | Escalated to Finance Director |
| FIN-2026-05 | Finance: bank reconciliations not reviewed | High | Monthly review and sign-off by Financial Controller | Financial Controller | 31 Aug 2026 | Closed | Three months’ signed reconciliations inspected |
Note the two “implemented” states. Separating Implemented (unvalidated) from Closed keeps management’s claim distinct from audit’s confirmation, which is exactly the distinction Standard 15.2 is concerned with.
Useful extra fields include original due date versus revised due date, number of extensions, date of last update and a “repeat finding” flag. If your team already analyses transaction data in the audit itself, for example payroll or vendor files, the same data can be re-run at follow-up to show the problem has gone away. For large files, a tool such as ProDataTool makes re-performing those tests quick.
Common mistakes that keep findings open
- Vague actions. If completion cannot be evidenced, it cannot be confirmed. Fix this at the exit meeting.
- Closing on management’s word. Status updates without evidence inflate closure rates and undermine audit’s credibility with the committee.
- Silent date changes. Overwriting the due date hides slippage. Keep the original date and count extensions.
- Department owners instead of named people. “Finance” never answers an email. A named owner does.
- Tracker held on one laptop. When that auditor leaves or the file is corrupted, the history goes with it.
- Reporting volume, not insight. Forty pages of open items lose the committee. Show ageing, high-rated overdue items and repeat findings.
- Ignoring root causes. If the same finding recurs across branches or provinces, the issue is likely a policy, system or capacity gap that one action owner cannot fix alone.
Quick checklist for your follow-up process
- Is there a documented follow-up methodology approved by the chief audit executive?
- Does every finding have a specific action, named owner, due date and expected evidence?
- Is there one central register with unique references linked to reports and working papers?
- Does audit validate implementation before closing, with depth matched to risk?
- Are escalation thresholds for overdue items defined and applied?
- Are risk acceptances documented and approved at the right level?
- Does the audit committee receive ageing, overdue and repeat-finding analysis each meeting?
Conclusion
Audit findings only create value when they are fixed. A disciplined follow-up process, built on trackable actions, evidence-based validation, clear escalation and concise committee reporting, turns internal audit from a fault-finding exercise into a driver of real control improvement. It also keeps your function aligned with the Global Internal Audit Standards.
If your team still tracks findings in spreadsheets and email threads, Auditors Track GRC brings it into one place. It is internal audit management software built for organisations across Africa, covering risk assessments, audit reviews, findings and report writing, with evidence attachments, dashboards by department and engagement type, and multi-user department assignments. Built-in libraries of controls, audits, working papers and risks help your team start quickly. Book a free demo of Auditors Track GRC and see how your findings could move from open to closed with a clear audit trail.