An audit recommendation that is agreed and never implemented is the most common outcome in the profession, and the function usually blames management for it. The blame is misplaced more often than not. Management agreed because agreeing ended the meeting; the action plan was written by the auditor; the date was chosen to make the report look complete; and nobody in the business ever owned the change. This guide is about the mechanics of yes: how recommendations get adopted and implemented rather than agreed and forgotten. It draws on what is known about ownership, framing and commitment, applies it to the specific setting of an audit finding, and describes the follow-through architecture that converts agreement into action. It is the companion to the guide on writing recommendations management can implement, which covers the words; this one covers what happens around them.
In this guide
- Agreed is not adopted
- Ownership transfer: their plan beats your prescription
- Loss framing, gain framing and the audience that decides
- Implementation-cost empathy
- The pilot-first gambit for big asks
- Commitment devices: making yes expensive to retract
- The closing-meeting script for the ask
- Timing: when the ask is made
- Follow-through architecture
- Reading resistance correctly
- Measuring adoption, not agreement
- Worked example: MidState Beverage’s route cash findings
- Frequently asked questions
- Related guides
Agreed is not adopted
Three outcomes are possible for every recommendation, and most tracking systems can only see two of them. A recommendation can be rejected, which is visible and rare. It can be agreed and implemented, which is visible and what the metrics report. Or it can be agreed and not implemented, which looks identical to the second outcome until the follow-up engagement, and which is the modal result in functions that measure agreement rates. The gap between agreement and adoption has a predictable anatomy.
| Why agreement happens | Why adoption does not | What the function sees | What is actually true |
|---|---|---|---|
| Agreeing ends an uncomfortable meeting | Nobody in the business wanted the change | Management response: “Agreed” | The action has no sponsor |
| The auditor wrote the action plan | The owner never understood what it required | A dated, specific plan | The plan describes the auditor’s fix, not the owner’s |
| The date was set to close the report | The date was never tested against capacity | A target date | A re-date in three months |
| The recommendation addresses the symptom | The cause is untouched, so the symptom returns | Closed, then a repeat finding next cycle | Nothing changed |
| The owner is a process manager | The fix needs budget the owner cannot authorise | An owner and a date | The real decision-maker was never in the room |
| Agreement was cheap | Implementation is expensive | A high agreement rate | A low implementation rate hidden by re-dating |
The life of a finding guide shows the stages between fieldwork and closure; most of the loss happens in the stage between “management response received” and “action started”, and the loss is invisible because the tracker records the response and waits for the date. The function that wants adoption has to intervene earlier, in how the recommendation is conceived, and later, in how the commitment is kept alive.
Ownership transfer: their plan beats your prescription
The single most reliable finding about getting people to act is that they act on plans they made. A recommendation written by the auditor and accepted by the owner is the auditor’s plan; an action designed by the owner to address a cause the auditor established is the owner’s plan, and the owner will defend it, resource it and remember it. The function’s job is therefore to transfer ownership deliberately: establish the cause beyond dispute, state the outcome the fix must achieve, and let the owner design the fix.
| Stage | Auditor owns | Owner owns | Technique |
|---|---|---|---|
| Condition | The facts, with evidence | Nothing; the facts are the facts | Facts agreed at the working level before the closing meeting; see writing conditions |
| Cause | The analysis | Confirmation that the cause is real | Root cause established jointly, in the room, using the 5 whys with the owner answering |
| Required outcome | The statement of what must be true afterwards | Agreement that the outcome is the right one | “When this is fixed, the following will be true” written as a testable statement |
| Action | A reference design if asked | The design, the sequence, the resources | The owner drafts the plan; the auditor evaluates it against the cause and the outcome, per evaluating management responses |
| Date | The challenge | The commitment | The owner proposes; the auditor asks what else is on the owner’s plate that quarter |
| Evidence of completion | The standard | Producing it | Agreed at the start; see evidence standards for issue closure |
Ownership transfer changes the closing meeting. Instead of presenting recommendations for acceptance, the auditor presents the cause and the required outcome and asks the owner how they would get there. The conversation is longer and the report is sometimes a week later; the actions that come out of it are implemented at two or three times the rate of auditor-written ones, in the experience of functions that have made the switch. The auditor keeps a reference design in reserve for owners who have no idea where to start, and offers it as one option among others rather than as the recommendation.
There is a limit. Ownership transfer does not mean accepting an action that does not address the cause, and the auditor’s evaluation of the proposed plan is where the line is held. A plan that treats the symptom, lacks a decision-maker who can fund it, or has a date chosen for comfort is pushed back with the reason, and the negotiating findings guide covers how to push without hardening positions.
Loss framing, gain framing and the audience that decides
The same recommendation can be framed as avoiding a loss or as securing a gain, and the two framings land differently with different audiences. Audit habitually uses loss framing (the exposure if nothing changes) because that is what the finding establishes. It works with some audiences and backfires with others.
| Audience | Framing that tends to work | Why | Example |
|---|---|---|---|
| Control owner (process manager) | Gain: fewer disputes, less rework, fewer escalations, an easier quarter | They live with the process daily; the loss is abstract, the friction is real | “Independent reconciliation review stops the month-end reruns your team does now” |
| Business head (P&L owner) | Loss, quantified and specific, plus the cost of the fix | They weigh exposure against cost; both numbers must be present | “About $1.4 million of unverified bank changes a quarter, against a two-day fix” |
| CFO | Loss, framed as reporting and certification exposure | Their personal exposure is the certification | “This is a deficiency we would have to evaluate under SOX if it persists through year-end” |
| Audit committee | Risk to the organisation and whether management has it in hand | They govern; they do not implement | “Management owns the fix; our concern is the date” |
| Technology leadership | Gain: a cleaner access model that removes recurring audit findings and exam questions | They are measured on delivery; recurring findings are drag | “One recertification process that answers audit, the external auditor and the regulator at once” |
| Regulated business (banks, insurers) | Loss framed as regulatory consequence | The regulator’s view is the one that moves budget | “The examiners asked about this in 2024; the next exam will look for a fix” |
Two refinements. The frame that works is the one that matches what the audience is measured on, which the auditor can usually find out by asking what the owner’s own scorecard contains. And loss framing has a ceiling: exposures stated in extremes (“could result in regulatory action”) lose force with every use, so the function should save the strong loss frames for the findings that deserve them and let the impact statement carry the number rather than the adjective.
Implementation-cost empathy
A recommendation that ignores what it costs to implement is read by the owner as evidence that the auditor does not understand the business, and it is quietly resisted even when agreed. Implementation-cost empathy means the auditor has worked out, before recommending, what the change requires in time, money, people and disruption, and has looked for the version of the fix with the best ratio of risk reduction to cost.
| Cost dimension | Question the auditor answers before recommending | Cheaper alternative that often exists |
|---|---|---|
| Time | How many hours, from whom, in which quarter? | A phased fix: the control for the highest-risk population first |
| Money | Does it need a system change, a licence, a hire? | A configuration change or a report rather than a new tool |
| Disruption | What stops while this is done? | Timing the change to an existing release or process refresh |
| Political cost | Who loses authority or convenience? | A compensating control that preserves the workflow and adds a check |
| Opportunity cost | What does the owner not do because of this? | Dropping a lower-value control the fix makes redundant; the key vs non-key logic |
| Recurring cost | What does the control cost every month forever? | Automation of the detective check through continuous monitoring |
The auditor who presents a fix with its cost already estimated and a cheaper alternative already considered has done the owner’s first week of work for them, and the recommendation is adopted because it arrives as a decision rather than a demand. The compensating controls guide covers the question of when a cheaper alternative is good enough and when it is not, which is the judgment the auditor must make before offering one.
The pilot-first gambit for big asks
Large recommendations fail for a reason that has nothing to do with their merit: nobody can commit to a change whose scale they cannot see. A new reconciliation process across 3,100 accounts, a user access recertification across 412 users and 74 roles, a vendor verification protocol for 2,590 vendors: each is right and each is too big to say yes to. The pilot-first gambit breaks the ask into a first step small enough to agree in the room and designed so that its success makes the full change inevitable.
- Pick the population that proves the point. The pilot covers the highest-risk slice (the 96 accounts outside the reconciliation tool; the 38 service accounts; the vendors with bank changes in the last quarter), so that even a pilot-only outcome reduces the exposure materially.
- Define the pilot’s success criterion with the owner. “If the pilot finds fewer than X exceptions, we stop; if more, we extend” converts the owner from defendant into experimenter.
- Keep the pilot inside the owner’s existing authority. A pilot that needs budget approval is not a pilot.
- Report the pilot’s result in the owner’s name. The extension to the full population is then the owner’s recommendation, not the auditor’s.
- Record the full change as the agreed end state. The tracker carries the whole recommendation with the pilot as milestone one, so that a successful pilot does not become the finish line.
The gambit has a failure mode: a pilot that is never extended, with the function closing the issue on the strength of the milestone. The fifth step guards against it. A function that tracks pilots as milestones and extensions as the closure criterion gets the benefit of the small first step without losing the big change.
Commitment devices: making yes expensive to retract
People keep commitments they made publicly, specifically and in their own words, and abandon ones made privately, vaguely and in someone else’s. Audit can design the moment of agreement so that the commitment has the first three properties, without any theatre.
| Commitment device | What it looks like in an audit setting | Why it works |
|---|---|---|
| Public | The owner states the action and date in the closing meeting with their manager present, or in the committee pack in their own name | Retracting a public commitment costs standing; retracting a private one costs nothing |
| Specific | The plan names the first step, the person who does it and the week it happens | Vague plans have no first step to miss |
| Self-authored | The owner writes the management response; the auditor edits for clarity only | People defend what they wrote |
| Pre-committed evidence | The owner agrees now what they will show at closure | The definition of done cannot drift |
| Reciprocal | The function commits to something too: a review of the design before go-live, a date for validation, help with the analytic | Obligation runs both ways |
| Visible progress | A milestone within 30 days that the owner reports to their executive | Early action predicts completion; early silence predicts re-dating |
The self-authored response is the device most functions already half-use and most often spoil. A management response drafted by the auditor “to save time” and signed by the owner is a commitment the owner never made. The ten minutes it takes the owner to write their own response are the best-spent ten minutes in the engagement, and the response that results is usually more specific than the auditor would have dared to write.
The closing-meeting script for the ask
The ask is made in the closing meeting, and the sequence of the conversation matters as much as its content. The script below assumes the facts were agreed during fieldwork and the cause was established with the owner, so that the meeting is about the fix.
1. Restate the agreed facts in one sentence. “We agreed that nine of the twelve depots have the cash counter doing the reconciliation.”
2. Restate the cause in the owner’s words. “You said the second clerk went in the 2024 reduction and nobody re-assigned the review.”
3. State the required outcome as a test. “When this is fixed, at every depot the reconciler is not the counter, and the reconciliation is evidenced daily. That is what we will test.”
4. Ask for the design. “How would you get there? We have a reference design if it helps, but you know the depots.”
5. Test the plan against cause, authority and capacity. “Does that address the clerk gap or work around it? Can you authorise it? What else is on the depots’ plate that quarter?”
6. Agree the first milestone, the evidence and the visibility. “First step by the 30th; the daily reconciliation log is what we will look at; this goes in the COO’s monthly review in your words.”
7. Offer the reciprocal. “We will review the regional clerk procedure before you roll it out, within a week of getting it.”
Closing-meeting script for the recommendation
The script never uses the word recommendation. The function has a finding, a cause and a required outcome; the owner has a plan. That framing is the ownership transfer in practice, and it is why the closing meeting playbook treats the meeting as a negotiation about remedies rather than a presentation of conclusions.
Timing: when the ask is made
Adoption depends on when the recommendation is made as much as on how. Three timing rules account for most of the difference.
- Before the report, not in it. A recommendation first seen in a draft report is a recommendation the owner reads defensively. Discussed during fieldwork, when the exception is fresh and the owner is still in problem-solving mode, it becomes a joint plan.
- At the owner’s planning moment. Every business has a cycle in which next quarter’s work is decided. An action that lands inside that cycle gets resourced; one that lands the week after waits a quarter.
- Not all at once. Nine recommendations delivered together get the attention of about three. The function sequences: the high-rated actions first and dated tightly; the lows batched into a single improvement plan with one owner and one date.
The closing meeting playbook describes the no-surprises discipline that makes the first rule possible. The second rule requires the auditor to know the business’s planning cycle, which is a question worth asking at the opening meeting and recording in the planning memo.
Follow-through architecture
Agreement decays. The mechanism that keeps it alive is architecture: dates, owners and visibility arranged so that inaction becomes more uncomfortable than action. Four components do most of the work.
| Component | Design | Failure it prevents |
|---|---|---|
| Named owner at the right level | The person who can authorise the resources, not the person who performs the control; a deputy named for continuity | The owner who cannot fund the fix; the owner who leaves |
| Milestones, not a single date | Two to four dated steps for anything over 90 days; the first within 30 days | The action that is “in progress” for a year |
| Visibility to someone the owner reports to | A monthly or quarterly status that the owner’s executive sees, in the owner’s own words | The action nobody outside audit knows about |
| A re-date rule | Second re-date requires the next rung of the escalation ladder and a reason recorded | Infinite deferral |
| Evidence standard agreed up front | What will be examined at closure, written into the action plan | The dispute at validation about what “done” means |
| A closure test the owner can run | The owner knows what the auditor will test and can test it first | Actions closed on assertion and reopened on validation |
The visibility component is the one owners resist and the one that matters most. An action plan that appears in the owner’s executive’s monthly review, with the owner’s own status against it, is an action that gets done, because the owner is now accountable to their own boss rather than to the auditor. Functions that negotiate this into the organisation’s management reporting have higher implementation rates than those that rely on audit’s tracker alone, and the sustainability testing guide shows how the same architecture keeps fixes fixed after closure.
Reading resistance correctly
Not all resistance is obstruction. Some of it is information the auditor should use, and the function that can tell the difference adopts the right recommendations and drops the wrong ones.
| Form of resistance | What it may mean | Response |
|---|---|---|
| “That is not how it works here” | The recommendation assumes a process that does not exist | Ask them to walk you through how it works; redesign |
| “We tried that” | A prior fix failed for a reason worth knowing | Ask what happened; address that cause |
| “We cannot afford it” | The fix is scoped too large, or the owner lacks authority | Offer the phased or compensating alternative; move the decision to the right level |
| “It is not a priority” | The loss frame did not land, or the risk is overstated | Re-examine the rating against the rule; if it holds, reframe for what the owner is measured on |
| “Agreed” with no questions | Nobody intends to do it | Ask how they would do it and when; a plan with no detail is not a plan |
| Silence after the meeting | The owner is waiting to see whether audit follows up | Follow up on day 30 as the architecture requires |
| Dispute of the facts | Either a real error or a delaying tactic | Return to the evidence; facts are not negotiated |
The second row is the most valuable and the most often ignored. An owner who says “we tried that” is offering the history of the control, and a recommendation that ignores the history will fail the same way the earlier attempt did. The auditor who asks what happened last time usually ends up with a better recommendation and an owner who feels heard, which is most of the psychology of yes in one exchange.
A practical habit for reading resistance is to write down, before the closing meeting, the objection you expect from each owner and the answer you would give. Owners rarely surprise an auditor who has done the exercise, and the answers that are weak on paper (usually the ones that rely on the rating alone) can be strengthened with a cheaper alternative or a reframe before the meeting rather than improvised in it. The exercise also surfaces the recommendation that cannot survive its likely objection, which is a recommendation to drop, not to argue for.
Measuring adoption, not agreement
A function that reports its agreement rate is measuring the wrong thing, and a committee that accepts the number is being told a comforting story. The measures that track adoption are harder to collect and more useful.
- Implementation rate at original date: the share of actions completed by the date first agreed, not the latest re-date. Functions that start measuring this usually find it below half.
- Re-date count per action: the distribution, and the share re-dated more than once.
- Validation pass rate: the share of actions closed by management that pass the function’s validation first time; see issue validation.
- Repeat-finding rate: the share of findings in a year that recur a prior finding; the measure of whether causes were addressed.
- Owner-designed share: the share of actions whose plan was written by the owner rather than the auditor, as a leading indicator.
- Sustainability rate: the share of validated fixes still operating at the next cycle.
The internal audit KPIs guide places these among thirty measures with targets. The function that reports implementation at original date, re-dates and repeat findings to the committee each quarter is making adoption visible, which is itself the strongest form of follow-through architecture there is.
Worked example: MidState Beverage’s route cash findings
MidState Beverage is a three-state drinks distributor with about $221 million of revenue, twelve depots, 300 routes and roughly $31 million a year collected by drivers in cash and cheques. Its FY27 route cash audit (report FY27-01, rated Unsatisfactory, 548 hours against 520 planned) produced five findings and eleven actions, and the six-person audit function used it to change how it handles recommendations.
The first finding, that depot cash reconciliations were not independent at nine of twelve depots, had been found in a lighter form two years earlier and “agreed”; nothing had changed, because the earlier recommendation (“implement independent review”) had been written by the auditor, owned by a depot manager with no authority over staffing, and dated to the report. This time the audit manager established the cause with the operations director in the room: depots had lost their second finance clerk in a 2024 cost reduction and the reconciliation had defaulted to the person who counted the cash. The required outcome was stated as a testable sentence: at every depot, the person who reconciles is not the person who counts, and the reconciliation is evidenced daily. The operations director, not the auditor, designed the fix: a regional finance clerk model covering three depots each, piloted in the two depots with the highest cash volume for 60 days, then extended.
The pilot was inside the director’s authority; the extension needed four hires and went to the CFO with the pilot result (eleven unexplained differences caught in 60 days at two depots, $6,300 recovered) as the director’s recommendation. The action appeared in the COO’s monthly operating review from month one, in the director’s own status language. Milestone one (pilot live) was dated 30 days out; the full model was live at month seven against a nine-month plan. The second finding, 1,412 self-approved overrides, was fixed by a configuration change the IT manager proposed himself once the cause (a stale delegation table) was on the whiteboard; it took a week and had been “agreed” in principle for three years.
The function changed its method after FY27-01. Causes are now established with the owner before the closing meeting; owners draft action plans against a required-outcome statement; actions over 90 days carry milestones; the second re-date goes to the next rung; and the quarterly pack reports implementation at original date, which was 44 percent for FY26 actions and 71 percent for FY27 actions at the time of the FY28 follow-up engagement, which also re-tested the route cash fixes and found the regional clerk model operating at all twelve depots.
Frequently asked questions
Why do audit recommendations get agreed but not implemented?
Because agreement is cheap and implementation is not. The common anatomy: the auditor wrote the plan, the owner lacked authority or understanding, the date was set to close the report, the fix addressed the symptom, and nobody outside audit could see the action. Each is fixable in how the recommendation is conceived and followed.
Should the auditor write the action plan?
No. The auditor establishes the cause and states the required outcome as a testable sentence; the owner designs the action. Owner-designed plans are implemented at a materially higher rate, and the auditor still evaluates the plan against the cause and pushes back on plans that treat the symptom.
How do you get management to accept a large recommendation?
Break it into a pilot the owner can agree to within their own authority, covering the highest-risk slice of the population, with a success criterion agreed in advance and the result reported in the owner’s name. Record the full change as the end state so the pilot does not become the finish line.
Is loss framing or gain framing more persuasive for audit findings?
It depends on the audience. Process owners respond to gains (less rework, fewer escalations); P&L owners and CFOs respond to quantified losses with the cost of the fix alongside; regulated businesses respond to regulatory consequence. Match the frame to what the audience is measured on, and keep strong loss frames for findings that deserve them.
What follow-up architecture keeps recommendations from decaying?
A named owner who can authorise resources, milestones rather than a single date, visibility of the action in the owner’s executive’s own reporting, a rule that the second re-date requires escalation, an evidence standard agreed up front, and a closure test the owner can run first.
What should internal audit measure instead of agreement rate?
Implementation at the original date, re-dates per action, first-time validation pass rate, repeat-finding rate, the share of owner-designed plans, and the sustainability of validated fixes at the next cycle. Reporting these to the committee is itself a form of follow-through.
Related guides
- Writing audit recommendations management can implement — the words that make adoption possible.
- Evaluating management responses — when to accept an action plan and when to push back.
- Negotiating audit findings without watering them down — scripts and escalation ladders.
- The escalation ladder — when and how to go over someone’s head.
- The trusted advisor path — how stature is earned.
- The life of a finding — from fieldwork observation to closed issue.
- Sustainability testing — validating that audit fixes stay fixed.
- Writing management action plans that actually close — the auditee’s craft.
- Root cause analysis for audit findings — 5 whys worked examples.
Leave a Reply