One of the most misleading measures in auditing is the percentage of findings closed on time.
Organizations proudly report closure rates. Audit programs track overdue actions.
Managers are held accountable for completing corrective actions within established deadlines.
Yet an important question is often overlooked: “Has the risk actually been reduced?”
The purpose of corrective action is not to close findings. The purpose is to prevent recurrence and reduce risk.
These are not always the same thing.
Most auditors have encountered situations where a finding is technically closed, yet the underlying issue still exists.
Sometimes an action plan consists of retraining employees, updating a procedure, or sending a communication to staff. The action is completed, evidence is provided, and the finding is closed. Months later, a similar issue reappears.
The problem was never the missing training record, the outdated procedure, or the communication itself. Those were symptoms. The real causes may have been competing priorities, inadequate resources, excessive workload, poor process design, weak supervision, or ineffective management controls.
The action addressed what was visible. The risk remained where it was.
Another common situation occurs when organizations postpone action without defining how they will manage the risk in the meantime. In reality, postponement is sometimes necessary. Budgets are limited. Resources are constrained. Facilities cannot replace equipment overnight. Systems cannot always be redesigned immediately.
The issue is not the delay.
The issue is the assumption that delaying action eliminates the need to manage the risk.
If a corrective action is postponed for several months, what is being done during those months? What controls are in place? How is the risk being monitored? Who owns it? What evidence demonstrates that the organization remains in control?
Too often, these questions go unasked.
The action date changes. The risk remains.
Organizations gradually become comfortable with this approach. Findings are reviewed, actions are reassigned, deadlines are extended, and progress reports continue to show activity. There is movement, but not necessarily improvement.
This creates a dangerous illusion. The organization begins to focus on managing findings rather than managing risks.
Auditors should challenge this distinction.
A finding should not be considered successfully closed simply because an action has been completed. It should be closed because there is confidence that the underlying vulnerability has been reduced to an acceptable level.
That requires a different conversation.
Instead of asking, “Was the action completed?” auditors should ask, “How do you ensure the risk has been reduced?”
Instead of asking, “When will the corrective action be implemented?” auditors should ask, “How is the risk being controlled until then?”
These questions move the discussion away from administrative closure and toward genuine improvement.
Because in the end, findings do not harm organizations.
Unmanaged risks do.
And a finding closed on paper, while the risk remains unchanged, may be one of the most dangerous of all.
