Management says the issue is fixed. The hardest question in internal audit follows: what would it take to believe them? The answer is usually weaker than it should be. Issues are closed on an email that says “done,” on a policy that was updated but never approved, on a training deck without an attendance list, on a screenshot of a configuration taken the day before validation, on a single transaction that went through the new process correctly. Each closure feels reasonable in isolation, and together they produce the pattern every mature function and every supervisor recognizes: the same findings, closed and reopened, year after year. Closure is a separate audit with its own evidence standard, and the standard is the subject of this guide.
It covers why closure is an audit, what the Standards and supervisors expect, the four-level evidence hierarchy, which level each rating and finding type requires, the minimum period of operation before validation, sample sizes for closure testing, the root cause test, evidence quality, the weak evidence that closes issues wrongly, validating regulatory findings, the closure vocabulary, a worked example at Lakeshore Bancorp, and the failures that recur. It anchors the site’s issue validation specialty alongside the issue validation guide, the validation workpaper basics, the sustainability testing guide and the closure memo template.
In this guide
- Why closure is a separate audit
- What the Standards and supervisors expect
- The four-level evidence hierarchy
- Which level each issue requires
- Minimum period of operation before validation
- Sample sizes for closure testing
- The root cause test: fix or patch
- Evidence quality: who produced it, how it was obtained, what it proves
- Weak evidence that closes issues wrongly
- Evidence by finding type
- Validating regulatory findings
- The closure vocabulary
- A worked example: Lakeshore Bancorp’s covenant tracking issue
- Failures that recur
- Questions about closure evidence
- Related guides
Why closure is a separate audit
An audit finding states that a control was missing or failed, with a cause and a consequence; management’s action plan states what will change. Closure asks a different question from either: has the change happened, does it work, and did it address what caused the problem? Answering it requires evidence of a different kind from the original audit (evidence about a new state of affairs rather than an old one), gathered after the change has operated long enough to produce something testable, and evaluated against the original condition rather than against management’s description of the fix. Three things make closure harder than it looks. The incentive asymmetry: management wants the issue closed, the auditor wants to move on, and the only party who benefits from rigor is the organization in a future nobody is measuring. The substitution problem: the evidence offered is usually evidence that an action was taken (a policy, a memo, a training session) when the question is whether a control operates and a condition has changed. And the time problem: validation is scheduled when the due date arrives, which is often before the fixed control has produced a population of operations to test. The life of an audit finding guide places closure at the end of the lifecycle; this guide is about the standard that lets it end honestly. The function’s credibility rests on it: an audit committee that learns an issue was closed on an email and then recurred has learned something about every closure the function ever reported.
What the Standards and supervisors expect
The Global Internal Audit Standards require the chief audit executive to establish a process to monitor the disposition of findings and to confirm the implementation of management’s action plans, with the extent of confirmation based on the risk the finding represents (Standard 15.2), and they set the general evidence standard that applies to that confirmation as to any other work: information gathered must be reliable, relevant and sufficient (Standard 14.1). The implication is a graded approach: the higher the risk, the more the function must do itself rather than accept management’s assertion. Supervisors in financial services are more specific. Matters requiring attention and the provisions of consent orders are expected to be validated by an independent function, normally internal audit, before the institution represents them as closed, and examiners evaluate both the effectiveness of the corrective action and its sustainability (the word appears throughout supervisory communications), which means evidence that the fix operates over time rather than at a point. The MRA explainer and the MRA lifecycle guide describe the process from the regulator’s side; the standards below are the ones that satisfy it. Outside financial services, the same expectations appear in different words: external auditors assess remediated deficiencies for a sufficient period of operation before year end, and the UK Corporate Governance Code’s 2024 declaration on material controls makes the board’s own statement depend on the quality of remediation evidence.
The four-level evidence hierarchy
Closure evidence sits on four levels, each stronger than the last, and the discipline is to know which level an issue requires and to refuse closure on a lower one.
| Level | What it proves | Typical evidence | What it does not prove |
|---|---|---|---|
| 1. Design artifact: a policy, procedure or standard was created or changed | Management has decided what should happen | Approved policy with version and date; procedure document; approval evidence from the right authority | That anyone does it; that it addresses the cause |
| 2. Implementation: the control was put in place | The mechanism exists | System configuration or code change with change-record evidence; training completed with attendance and assessment; role assigned with the job description changed; tool deployed; report built and distributed | That it operates as designed over time; that exceptions are handled |
| 3. Operating effectiveness: the control has operated over a period | The mechanism works in practice | A tested population of operations after the implementation date: reconciliations performed and reviewed, approvals obtained, exceptions identified and handled, with re-performance or inspection by the validator | That the original condition has gone away, if the finding was about outcomes |
| 4. Outcome: the condition identified in the finding no longer exists | The problem is fixed | The original analytic re-run over the post-remediation period showing the exception rate within tolerance; the error, loss or breach rate down; the regulatory metric met; the backlog cleared and staying clear | That it will stay fixed, which is the sustainability question |
Most wrongly closed issues were closed at level 1 or 2 when they required level 3 or 4. The policy was updated, the training was delivered, and nobody tested whether the covenant certificates were now being chased or the duplicate payments had stopped. The hierarchy also clarifies what the validator does: at levels 1 and 2 the validator inspects artifacts; at level 3 the validator tests a population using the methods in the walkthrough versus test of controls guide; at level 4 the validator re-performs the original audit’s measurement.
Which level each issue requires
| Issue rating and type | Minimum level to close | Who gathers the evidence | Notes |
|---|---|---|---|
| High (or Critical), any type | Level 3, and level 4 where the finding was stated as an outcome (error rate, loss, breach, backlog) | Internal audit tests directly | No closure on management’s assertion; regulatory findings add the sustainability period |
| Medium, operating or outcome finding | Level 3 | Internal audit tests, or reviews management’s testing and re-performs a portion | Level 4 where the analytic is cheap to re-run |
| Medium, design finding (control missing by design) | Level 2, with level 3 at the next scheduled audit or a sustainability check | Internal audit inspects implementation | Record the follow-up test in the tracker |
| Low, any type | Level 2, or level 1 with management attestation where the risk justifies no more | Management attests; internal audit samples attestations | Disclose the attestation basis in reporting |
| Regulatory (MRA, consent order provision, examination finding) | Level 3 plus a defined sustainability period, and level 4 where the finding cites a metric | Internal audit, independent of the remediation program | Validation precedes the institution’s closure request to the regulator |
| Repeat finding (previously closed and recurred) | One level higher than the original closure, and a root cause re-analysis | Internal audit | Report to the audit committee as a repeat |
| Risk accepted by management | Not a closure: documented acceptance at the authority the policy requires, reported to the committee | Management, with internal audit recording | Revisit at a defined date |
Minimum period of operation before validation
Level 3 evidence requires a population, and a population requires time. A control implemented on the first of the month cannot be validated on the fifteenth with any conclusion beyond “it has started.” The rule of thumb is a period long enough to produce enough operations for the sample sizes below, and long enough for the control to meet its first exceptions: for daily and transaction-level controls, at least one full month and preferably a quarter; for weekly controls, a quarter; for monthly controls, three cycles; for quarterly controls, two cycles; for annual controls, one cycle, which means the issue stays open for a year with interim level 2 evidence recorded. The practical consequence is that action plan due dates and validation dates are different dates, and the tracker should hold both: the date by which management will implement, and the date by which the control will have operated long enough to validate. Validating at the due date because the due date arrived is the most common cause of premature closure; the sustainability testing guide extends the logic to the period after closure. For regulatory findings the sustainability period is often set by the supervisor’s expectation or the order’s terms, and three months of operation is a common minimum for a monthly or more frequent control, with longer periods for complex programs.
Sample sizes for closure testing
Closure testing uses the same sampling logic as the original audit (the sample sizes and attribute sampling guides), with two adjustments. The population is shorter (the post-implementation period only), so the sample is often a large share of it or the whole of it; and the tolerable deviation is lower, because the question is whether a newly fixed control works, not whether an established control has drifted, and any exception in a fresh population is a signal about the fix rather than noise. A workable table for closure testing by control frequency: annual, the one instance; quarterly, both instances in the period; monthly, all three in a three-month period; weekly, 10 to 15 from a quarter; daily, 25 from a quarter (40 where the control is key or the finding was High); multiple times a day or transaction level, 40 to 60 from the period, or the whole population through analytics where the data allows. Where the finding was stated as an outcome, the sample is replaced by the re-run analytic over the full post-remediation population, which is both cheaper and more convincing than any sample. Exceptions in closure testing are not projected; one exception sends the validator to the cause of the exception, and the conclusion depends on whether it reveals a fix that does not work (not validated) or an isolated lapse in a working control (validated, with the lapse reported).
The root cause test: fix or patch
A remediation can make the condition disappear without touching the cause, and the issue will return. The original finding named a cause (the cause statements and root cause analysis guides); the closure test asks whether the action plan addressed that cause or only its symptom. A duplicate-payment finding whose cause was an exact-match check switched off during a system migration is fixed by turning the check back on and controlling configuration changes, not by a monthly duplicate report that catches payments after they leave. A covenant-tracking finding whose cause was that loan agreements were never loaded into the tracking system is fixed by a loading control at closing, not by a one-time reconciliation. A late-reporting finding whose cause was that one person knew the deadlines is fixed by a calendar and a backup, not by a reminder to that person. The validator writes a sentence in the closure memo that connects the action to the cause, and where the connection is missing, the closure is partial even if the condition has gone: the memo records the residual risk, and the sustainability test is scheduled with that in mind. Management’s action plans often drift toward symptoms because symptoms are cheaper to treat; the management responses guide covers how to evaluate the plan at the start so the closure conversation is not the first time the gap is raised.
Evidence quality: who produced it, how it was obtained, what it proves
Three attributes decide whether a piece of closure evidence is worth anything. Source: evidence the validator obtained directly from the system (a query run by the auditor, a report generated in the auditor’s presence, a configuration screen the auditor navigated to) outranks evidence management produced and sent (a screenshot, an exported list, a summary), which outranks evidence management described (an email, a statement in a meeting). Integrity: a report is only as good as the parameters that produced it, so the validator records the parameters, checks completeness against an independent total, and treats information produced by the entity with the care the IPE testing guide describes; a screenshot without a system date, a user and visible parameters proves little. Relevance: the evidence must relate to the control in the finding and the period after implementation; evidence of a different control, a different population or the pre-implementation period is irrelevant however good it looks. The audit evidence guide’s standards of sufficiency, reliability and relevance apply in full, and closure is where they are most often relaxed because the validator is checking someone else’s claim rather than building a case. A useful habit: for every closure, the validator should be able to say what evidence they personally obtained and what they would show an examiner who asked.
Weak evidence that closes issues wrongly
| Evidence offered | Why it is weak | What to ask for instead |
|---|---|---|
| An email from the owner saying the action is complete | Assertion, not evidence; proves intent at best | The artifact and the operating population |
| A policy or procedure document | Level 1; proves a decision, not a practice; often unapproved or uncommunicated | Approval evidence, communication evidence, and operation under the policy |
| A training deck | Proves content exists; not who attended, understood or applies it | Attendance against the target population, assessment results, and operation |
| A screenshot of a configuration | Point in time, often taken for the validator; no change history | Configuration viewed by the validator with the change record and effective date |
| One example transaction | A sample of one; usually selected by management | A validator-selected sample from the population after implementation |
| A report built to show the control | Information produced by the entity, untested | Parameters, completeness check, re-performance of a portion |
| A reconciliation performed once | Fixes the symptom at a point; the control is the recurring process | The recurring reconciliations over the period, reviewed and signed |
| A “monitoring report” nobody acts on | Detection without response is not a control | Exceptions identified, dispositioned and escalated over the period |
| Management’s own testing summary | Second-hand; may be well done or not | The workpapers, with re-performance of a sample by the validator |
| Evidence from before the implementation date | Irrelevant to the fix | Post-implementation period only |
| A plan to do it | Not done | Keep the issue open; record interim progress |
Evidence by finding type
| Finding type | Level 2 evidence | Level 3 evidence | Level 4 evidence |
|---|---|---|---|
| Control missing (design) | Control designed, documented, assigned and implemented in process or system | Operations of the new control over the period, tested | The exposure the missing control created, measured and reduced |
| Control not operating (performance) | Cause addressed: staffing, tooling, training, system fix | Operations over the period, including exception handling | Original exception rate re-measured |
| Outcome finding (errors, losses, breaches, backlog) | Process changes implemented | Controls operating | Required: the analytic re-run; the rate, loss or backlog within tolerance for the period |
| Compliance finding (requirement unmet) | Procedure and ownership for the requirement | Requirement met across the population for the period (filings on time, disclosures correct) | Regulator’s acceptance where applicable |
| IT configuration or access | Configuration changed with change record; access removed with approval | Configuration stable over the period (change log); access reviews operating; no re-grants without approval | Access analytics re-run showing no conflicts |
| People and competence | Roles filled; training delivered with attendance and assessment | Work product quality over the period (reviews, error rates) | Quality metric within tolerance |
| Third-party control | Contract amended; vendor action evidenced | Vendor reporting and the organization’s oversight over the period; a vendor audit where risk justifies | Service and control metrics within tolerance |
| Data integrity | Data corrected; source control implemented | Reconciliation operating; new records correct over the period | Error rate on the data re-measured |
| Governance (reporting, committee, authority) | Charter or matrix changed; report redesigned | Meetings, reports and approvals over the period as required | The oversight gap closed: the committee saw and acted on what it previously did not |
Validating regulatory findings
When the finding came from a supervisor, closure has an external audience whose standards are explicit and whose patience is finite. The sequence is: management remediates under a plan with milestones; the remediation program (often a dedicated office) performs its own testing; internal audit validates independently, with its own evidence, to the standard the supervisor will apply (effectiveness over a sustainability period, root cause addressed, the specific language of the finding met); and only then does the institution request closure, attaching or summarizing the validation. Internal audit’s independence from the remediation program is essential: the function that designed the fix or sat on the steering committee cannot validate it, and the independence guide covers the safeguards when the function is small. Validation workpapers for regulatory findings are written for the examiner as a reader: the finding quoted, each required element mapped to the evidence that addresses it, the testing described in enough detail to be re-performed, and the conclusion in the supervisor’s terms. Examiners will test the validation, and a validation that an examiner overturns damages the function more than the original finding damaged the institution. The continuous regulatory readiness guide covers the posture that makes this routine, and the regulators’ expectations guide what the examiner is looking for.
The closure vocabulary
Precise closure language prevents the ambiguity in which issues disappear. Validated: internal audit tested the remediation to the required evidence level and concluded that the control operates and the condition is addressed; the issue is closed, with a sustainability test scheduled where the rating requires one. Partially validated: some actions are complete and effective, others are not or cannot yet be tested; the completed elements are recorded, the issue remains open with residual actions and a new validation date, and the rating is reassessed for the residual risk. Not validated: the remediation is incomplete or ineffective; the issue remains open at its rating (or higher if the risk has grown), the owner and due date are reset, and the result is reported to the audit committee for High issues. Risk accepted: management has decided not to remediate and has accepted the risk at the authority the policy requires (High risks usually need the committee), documented with the rationale and a revisit date; this is not a closure and is reported as what it is. Superseded or no longer applicable: the process, system or activity has been discontinued, confirmed by the validator; recorded with evidence. Closed, management attestation: for Low issues where the policy permits, with the attestation basis disclosed. Each term carries a defined evidence level and a defined reporting treatment, which the closure memo template builds into its conclusion section and the issue tracking guide into the tracker’s status field.
A worked example: Lakeshore Bancorp’s covenant tracking issue
Lakeshore Bancorp’s FY26 underwriting audit found that 31 percent of financial covenants in sampled loan agreements were not loaded in the covenant tracking system, 18 percent of loaded covenants were past due for compliance certificates with no follow-up, and four breaches had been waived by the originating officer without the required approval; the finding was rated High with the cause stated as the absence of a loading control at closing (covenants were entered by the closing team from memory of the term sheet, with no reconciliation to the executed agreement) and no exception reporting on certificate aging. Management’s action plan, due in 120 days, had four elements: reconcile the 400 largest relationships’ agreements to the tracking system and correct the loads; add a closing checklist step requiring covenant entry from the executed agreement with a second-person check; build an aging report for certificates past due, reviewed monthly by credit administration with escalation at 30 days; and route waiver approvals through the credit system’s authority matrix.
| Action | Evidence management offered | Evidence the validator obtained | Level and result |
|---|---|---|---|
| Reconcile the top 400 relationships | Spreadsheet listing 400 relationships marked “reconciled” | Validator selected 40 relationships, pulled the executed agreements from the imaging system, and compared every financial covenant to the tracking system: 39 complete and correct, one with a leverage covenant definition entered incorrectly | Level 4 for the reconciled population (the original 31 percent gap re-measured at 2.5 percent, one definitional error); correction made |
| Closing checklist step with second-person check | Updated checklist; email announcing the change | Checklist approved by the chief credit officer (level 1); loan system shows the checklist step as mandatory since the implementation date (level 2); validator tested all 62 commercial loans closed in the three months after implementation against their agreements: 60 complete, 2 with a reporting covenant omitted, both by the same closer in the first two weeks | Level 3 with two early exceptions attributable to the transition; the second-person check caught neither, which the validator traced to the checker signing before the entry was made in 9 of 62 cases |
| Certificate aging report and monthly review | A copy of the report | Report generated in the validator’s presence with parameters recorded; completeness checked against the covenant population; three months of review sign-offs with documented follow-up on 41 of 44 past-due items, escalation at 30 days on 6 | Level 3; the three items without follow-up were in the first month |
| Waiver approval through the authority matrix | Statement that waivers now require approval | System configuration viewed: waiver transaction routed to the authority matrix since the implementation date; all 11 waivers in the period approved at the required level; the four original unauthorized waivers ratified by committee | Level 3 for the period |
| Root cause | — | The cause (no loading control, no aging visibility) is addressed by the checklist and the report; the second-person check’s timing weakness is a residual design gap | Addressed, with a residual |
Conclusion: partially validated. The reconciliation, the aging report and the waiver routing were validated; the closing control was operating but with a design weakness in the second-person check that management agreed to fix by requiring the checker’s sign-off after the entry, with a 30-day residual action and a re-test of the next quarter’s closings. The issue remained open at Medium for the residual, the committee saw the result in the quarterly tracker report, and a sustainability test (the covenant load completeness analytic re-run across all closings) was scheduled for six months after final closure under the sustainability guide. The closure memo template shows this example written up in full.
Failures that recur
| Failure | How it shows | What to do instead |
|---|---|---|
| Closure on assertion | Email says done; issue closed | Evidence level by rating; no High closed below level 3 |
| Validation at the due date | Control two weeks old “validated” | Separate implementation and validation dates; minimum period of operation |
| Artifacts for operations | Policy and training accepted for a performance finding | Match evidence type to finding type |
| Management’s sample | One example transaction, chosen by the owner | Validator selects from the post-implementation population |
| Screenshots as evidence | Undated images without parameters | Validator-obtained evidence with change records |
| Symptom treated, cause ignored | Issue recurs a year later | Root cause sentence in every closure memo |
| Outcome findings closed on process evidence | Controls operating, error rate never re-measured | Re-run the original analytic |
| Regulatory closure before validation | Examiner overturns the closure | Validate independently first, to the supervisor’s standard |
| “Partially validated” used as a soft close | Residual actions never tracked | Partial means open, with dates and reporting |
| Risk acceptance by the issue owner | Low-level acceptance of High risks | Acceptance authority by rating; committee reporting |
Questions about closure evidence
What evidence is needed to close an audit issue?
It depends on the rating and the type: High issues need evidence that the control has operated over a period (a tested post-implementation population) and, where the finding was an outcome, that the original measurement is now within tolerance; Medium design findings can close on implementation evidence with a later operating test; Low issues can close on management attestation where the policy allows. A policy document or an email never closes a High issue.
How long must a control operate before validation?
Long enough to produce a testable population and meet its first exceptions: at least a month and preferably a quarter for daily or transaction controls, a quarter for weekly, three cycles for monthly, two for quarterly and one for annual controls; regulatory findings often carry a defined sustainability period of three months or more.
What sample size is used for closure testing?
All instances for annual, quarterly and monthly controls in the period; 10 to 15 for weekly; 25 for daily (40 for key controls or High findings); 40 to 60 for transaction-level controls, or the full population through analytics; and the original analytic re-run over the whole post-remediation period for outcome findings. Exceptions are investigated, not projected.
What is the difference between validated and partially validated?
Validated means every action was tested to the required level and the condition is addressed, so the issue closes (with a sustainability test where required). Partially validated means some elements are effective and others are incomplete, ineffective or untestable yet; the issue stays open with residual actions, a new date and a reassessed rating, and is reported as open.
Can management close its own issues?
For Low issues, management attestation with internal audit sampling is a common and acceptable policy. For Medium and High issues, internal audit validates; for regulatory findings, independent validation by internal audit precedes any representation to the supervisor. Management accepting a risk rather than remediating is a separate, documented decision at the right authority, not a closure.
Why do closed issues recur?
Usually because the closure accepted artifacts (policies, training, screenshots) in place of operating evidence, because validation happened before the control had operated, or because the remediation treated the symptom while the cause stated in the finding remained; the sustainability testing guide covers how to catch recurrence early.
Related guides
- Issue validation in internal audit — the specialty’s overview.
- Basics of issue validation workpapers — the workpaper foundation.
- Sustainability testing: validating that fixes stay fixed — after closure.
- The issue closure memo: a template that stands up to regulators — the deliverable.
- The life of an audit finding — where closure sits.
- Evaluating management responses — judging the action plan at the start.
- Root cause analysis for audit findings — the cause the fix must address.
- Writing audit finding cause statements — stating the cause testably.
- Tracking internal audit issues — the tracker and its status field.
- High-risk vs low-risk issues — graded treatment.
- Audit evidence — sufficiency, reliability and relevance.
- IPE testing — reports as evidence.
- Walkthrough vs test of controls — level 2 versus level 3.
- Audit sample sizes — the tables closure testing adapts.
- Attribute sampling — the method.
- MRAs, MRIAs and consent orders explained — the regulatory audience.
- The MRA and MRIA lifecycle — validation in the regulatory process.
- Continuous regulatory readiness — the posture.
- What regulators really expect — the examiner’s view.
- Independence and objectivity — the validator’s independence from the fix.
- Auditing the underwriting process — the Lakeshore finding being closed.
Leave a Reply