Who owns an action plan, audit or management?

Management owns the action and the date. Internal audit owns the record, the reminder and the verification. Audit taking ownership of the fix is the fastest way to end up doing management's work and losing independence.

What counts as evidence to close an issue?

Something you could show a third party: the updated policy with its approval, a screenshot of the changed configuration, a sample retested after the change. An email saying it is done is a claim, not evidence.

How do you handle an action plan that keeps being extended?

Allow one extension with a reason, then escalate the second one to the audit committee as an overdue item with its history. A date moved three times quietly is a decision nobody made.

Should low-rated observations be tracked too?

Track them, but chase them less. The value of tracking everything is that a pattern of small repeat findings in one area becomes visible, which is often the better finding.

From observation to closed issue: tracking management action plans

Most audit functions are good at finding things and weak at closing them. The observation is written, management agrees, an action is promised, and six months later nobody can say exactly which promises were kept. The work that produced the finding is already spent by then; only the follow-up converts it into a change.

What makes an action plan trackable

An action plan that can be tracked has five things. Missing any one of them, and the follow-up turns into archaeology.

A named owner, a person and not a department. Departments do not answer emails.
A dated commitment chosen by the owner, not by the auditor. A date someone picked for you is a date you feel free to miss.
An action written as a change, so completion is observable: "remove the two lapsed approvers and update the matrix", not "review access".
The evidence that will close it, agreed at the time it is written. Deciding at closure what counts as proof is how issues close on an email.
A link back to the observation, so the reason still exists when the owner has changed jobs.

The last one matters more over time than it looks. Two years later the fix is questioned, the original auditor has left, and the only thing that explains it is the chain from issue back to observation, work paper and evidence.

Who chases, and how often

Internal audit keeps the register and sends the reminders; management does the work. Two rhythms are enough:

Monthly, a list to each owner of their own open items, with the ones due this month marked.
Quarterly, a summary to the audit committee: open, closed, overdue, and anything overdue for more than one period, with names.

The difference between a follow-up process that works and one that does not is usually whether overdue items reach the audit committee by default. If reporting an overdue item requires the audit lead to decide to escalate it, most of them will be handled with a phone call instead, and the register slowly fills with items everyone has stopped believing.

Closing an issue honestly

Closure needs three things: the evidence that was agreed, someone in audit who checked it, and a date. Two common shortcuts quietly damage the register:

Closing on assertion. The owner says it is done, the item is closed, and nobody looks. The register stays tidy and stops meaning anything.

Closing by redefinition. The action becomes smaller until it matches what was actually done. If the agreed action is no longer the right one, say that, record the new one and the reason, and let the change be visible.

An issue that is not going to be fixed is a legitimate outcome too: management accepts the risk. That is a decision with a name attached, recorded and reported. It is not the same as an item lingering at "in progress" for a year.

What to report

Four numbers tell the audit committee most of what it needs: how many issues are open, how many are overdue, how long the overdue ones have been open, and how many were closed since the last meeting. Add the pattern: which area carries most of the overdue items, and which findings have come back after being closed.

How AuditEase Pro tracks them

Observations become issues with an owner, an action plan, a due date and a status. The business owner logs in and sees their own items, so the reminder is not an email thread the audit team maintains by hand. Overdue items are visible as overdue rather than counted by hand, and the analytics show open, overdue and closed counts by area for the audit committee pack.

Because the issue keeps its link to the observation and its evidence, a question in a later year is answered from the record rather than from memory. And because auditees have their own role, giving them access is a rollout decision, not a licence cost: the system is quoted per customer, not per seat.

The demo has an issue register with overdue items in it, so you can see the follow-up view from both seats: the audit team's and the business owner's.