If you are going to miss an audit action due date, the move that protects you is the same in every audit function: tell the audit team and your executive sponsor the moment the critical path says the date is gone, in writing, with four things attached: what is done, with evidence; what remains, as work packages with durations; the interim measure holding the risk down meanwhile; and a new date built from the remaining work plus the operating period validators will need before they can close the issue. A first extension requested that way, before the due date, is approved in most functions, usually by your own executive rather than by internal audit, and recorded with the original date preserved. What costs you is not the slip. It is the silence. An action that internal audit discovers overdue at follow-up, or a second extension on the same action, is what reaches the audit committee pack with your executive’s name against it.
This guide is the owner’s side of a problem the auditor-side guides treat as a metric: what “overdue” means in the issue system and the committee pack, when to raise a slip, the one-page request (template included), which reasons are accepted, how functions decide on first, second and third requests, how an extension reads once it is reported upward, the risk-acceptance alternative for actions that will never happen, re-planning, interim mitigation, a worked example and the weekly habit that prevents the second one. It assumes the action was written the way Writing Management Action Plans That Actually Close describes and that you are running remediation along the lines of the 90-day remediation plan. If you are new to the audited side altogether, start at the Being Audited? hub.
Three words are used precisely throughout. An extension is an approved change to an action’s target date, counted and attributed to whoever approved it. A re-plan is a change to the action itself. Overdue means the current target date has passed without the action being submitted for validation. The tracker records these distinctions even when conversation blurs them, and the tracker is what the committee reads.
In this guide
- What “overdue” means in the issue system and the committee pack
- When to raise it: the moment the critical path says so
- The extension request, on one page
- Reasons that are accepted and reasons that are not
- How audit functions decide: the first, second and third request
- How an extension reads upward, and whose name sits next to it
- When the action will never be done: the risk-acceptance alternative
- Re-planning from the critical path, not from hope
- Interim mitigation that buys credibility
- Worked example: Northgate Logistics and the connector that moved
- Avoiding the second one
- Questions readers ask
- Related guides
What “overdue” means in the issue system and the committee pack
Every issue tracker worth the name carries two dates for each action: the original target date, which is never overwritten, and the current target date, which moves only through an approved extension that is counted and attributed to its approver. The audit issue tracking data model explains why the original date is protected: without it the issue is never overdue, because the date always moves, and the extension history disappears with it. Functions that learned this the hard way also lock the date field so that owners cannot change it themselves. That design has two consequences you can use.
First, an extension approved before the due date does not make the action overdue. It makes it “extended once”, which is a different row in a different table, with an approver’s name next to it rather than a count of days. Second, in many functions submitting your evidence before the date stops the clock even when validation takes weeks. The action sits in a state usually called “submitted for validation”, and the time internal audit takes to test it is audit’s lead time, not your overdue days. Confirm how your own tracker treats that state rather than assuming it. The guide to getting a finding closed covers what the submission has to contain; the point here is that the submission date, not the validation date, is what you are measured against.
Once an action is overdue, two clocks run. The tracker ages the issue from the report date in bands, commonly 0–90, 91–180, 181–365 and over 365 days, and ages the overdue action in days past the current target date. The quarterly pack rarely shows either list in full; it shows the metrics built from them: overdue issues by rating and the share overdue, the average and oldest age of open high-rated issues, issues extended more than once, risk acceptances, and remediation by executive owner. The guide to reporting to the audit committee gives the readings most committees apply: under 10 percent overdue and no high-rated issue more than one quarter overdue reads as healthy; serial extensions approved by the issue owner read as a warning. Its line, “extensions are how issues die quietly”, is the one to keep in mind while drafting: the committee has been told to watch for what you are about to ask for, so the request has to look nothing like a quiet death.
| Tracker state | What it means | Where it appears | Who sees it | What it usually triggers |
|---|---|---|---|---|
| Open, due within 30 days | On the look-ahead; nothing has slipped | Your status report; audit’s follow-up list | You; audit’s issue coordinator | A reminder from audit; your weekly check of the critical path |
| Extended once, approved before the date | Current date moved; original preserved; count 1; approver recorded | Tracker; executive’s monthly status; pack appendix in aggregate | Your executive; audit | Normal follow-up, provided the interim measure holds |
| Submitted for validation | Evidence in before the date; clock stopped | Audit’s validation queue | Audit | Validation, typically within about a month for high and medium issues where a service standard exists |
| Overdue 1–30 days, no request made | Date passed; no submission; no approved extension | Follow-up list; executive’s report | Your executive; the audit manager | A working-level conversation; a new date with reason, recorded as a missed date |
| Overdue 31–90 days, or any high-rated action overdue | Pattern forming; high-rated items escalate by rule in many functions | Executive committee list; audit’s escalation log | The CEO’s team; the CAE | Sponsor-level conversation: fund it, re-plan it or formally accept the risk |
| Overdue more than 90 days, or high-rated and overdue around two months | Chronic; in the convention used across these guides, high overdue items reach the committee by name at about 60 days | Committee pack, in the body not the appendix | The committee; the CAE | Named reporting; an executive-owned date or a formal risk acceptance |
| Extended twice or more | Second or later extension, whatever the reason | Reported individually in the pack | The committee | CAE involvement; a third extension is rarely granted as one |
| Validation failed | Reopened; some functions count overdue days from the original date | Pack: closures reopened this quarter | The committee | A new plan; the rating may be revisited; read as worse than a slip |
When to raise it: the moment the critical path says so
The rule is to raise a slip the moment you know, and “know” has a definition. You know when the remaining work, laid end to end with the dependency dates you actually hold in writing, no longer fits before the due date. Not when you feel uneasy, and not when the date has passed. The 30-day look-ahead in the 90-day plan exists to produce that knowledge on a schedule rather than as a surprise: every week you ask, for every open action, whether a feasible path to the date still exists. The week the answer turns to no is the week you write.
Timing matters more than the reason. Internal audit reads a slip raised early as a planning event: the owner is tracking the plan, saw the problem and acted. It reads a slip discovered at follow-up as a control-environment event: nobody was watching, and audit found out by asking. The same six-week delay is “extended once, approved by the COO, interim measure in place” in the first case and “overdue 45 days, owner unresponsive until contacted” in the second. Practitioner judgment, from years of writing those notes: most of the credibility damage from a missed date is self-inflicted by waiting, and the owners who get a second extension approved without a fight are almost always the ones who raised the first before anybody asked.
| When you raise it | How the audit team reads it | What you can usually get | What it costs you |
|---|---|---|---|
| 30 or more days before the date, from your own look-ahead | Planning discipline | A first extension to a re-planned date; often an agreement to split the action so the independent part closes on time | Very little; one “extended once” row with your executive’s name as approver |
| 8–29 days before | Normal | A first extension, with the interim measure evidenced | Little, provided the request is complete |
| 1–7 days before | Late; questions about whether you track your own plan | An extension, but with milestones audit can check and an earlier follow-up date | Some credibility; the audit manager is now watching the action personally |
| On the date, in reply to audit’s reminder | Reactive | A new date recorded as a missed date plus an extension | “Overdue” enters the history; a conversation with your manager if the issue is high-rated |
| After the date, when audit follows up | Owner not tracking; possible non-engagement | A new date demanded with a reason; sponsor notified for high-rated issues | Overdue days accrue; named on your executive’s report; the pattern follows you into the next audit |
| At validation, when the fix fails testing | Premature completion claim | The issue is reopened with a new plan | Treated as worse than a slip; the pack shows “validation failed”; any further date is effectively a second extension |
The difference between a request approved in a day and one that triggers a meeting is mostly specificity. The table below is the conversation with the auditor; it works equally well as the opening of the written request.
| Moment | Say | Don’t say |
|---|---|---|
| Opening line | “The 31 March date for action 2.1 is not achievable. Here is why, what is in place meanwhile, and the date I can commit to.” | “We may need a bit more time on 2.1.” |
| The reason | “The vendor moved the connector from the March release to June; their notice of 18 February is attached.” | “IT has been slammed.” |
| What is done | “Standing admin access was removed from all eleven accounts on 12 March; the change tickets are attached.” | “We have made good progress.” |
| The interim measure | “A manual quarterly privileged-access review from the system user export ran on 15 March; the reviewer’s sign-off is attached and it continues until the automated review is validated.” | “The risk is low anyway.” |
| The new date | “31 August, which includes one full quarterly cycle of the new control before we submit for validation.” | “Hopefully by the summer.” |
| The ask | “Please record a first extension to 31 August. The COO approved it on 2 March; her email is attached.” | “Can you just move the date?” |
The extension request, on one page
Address the request to the person in internal audit who owns follow-up for your issue (the issue coordinator or the engagement manager) and copy your executive sponsor. In many methodologies the sponsor approves the first extension and audit records it; a request that arrives already approved by the sponsor goes through in a day, because audit’s job becomes checking the content rather than chasing an approval. Keep it to one page and attach the evidence rather than describing it. A request that says “evidence available on request” is read as a request without evidence.
| Field | What to write | Example (Northgate Logistics, action 2.1) |
|---|---|---|
| Issue reference, rating, report | Exactly as the tracker names it | Report 26-14 Warehouse Systems Access, finding 2 (High), action 2.1 |
| Original target date | The date in the final report; never changes | 31 March 2027 |
| Current date and extension count | Shows you know your own history | 31 March 2027; no prior extension |
| Proposed new date | One date, from the re-planning worksheet below | 31 August 2027 |
| What is done, with evidence | Completed work packages, each with a reference | Standing admin access removed, 11 of 11 accounts (tickets 4471–4481; screenshots dated 12 March) |
| What remains, with durations | Deliverables, not activities; durations from history | Connector install (vendor, June release); configuration and testing (3 weeks); first automated review (July); evidence pack (1 week) |
| What changed since the date was set | The single fact that broke the plan, with proof | Vendor moved the connector from the March to the June release (notice of 18 February attached) |
| Interim measure | Owner, start date, evidence, end condition | Manual quarterly review from the WMS user export; first run 15 March; sign-off attached; runs until the first automated cycle is validated |
| Dependencies, confirmed in writing | Who, what, by when, confirmed how | Vendor release 12 June (release notice); IAM capacity for June confirmed by the IAM lead (email) |
| Operating period built into the date | Cycles the new control runs before submission, as agreed with audit | One automated cycle (July) before submission in mid-August, agreed with the audit manager on the strength of the March and June manual reviews |
| Milestones audit can check | Three to five dated checkpoints | 12 June connector; 2 July configuration; 31 July first automated review; 13 August evidence submitted |
| Sponsor approval | Name, date, attachment | COO approved 2 March (email attached) |
| The ask | One sentence | Record extension 1 to 31 August and schedule validation for September |
On receipt, the auditor checks three things, in this order: whether the new date has work behind it, whether the risk is held down meanwhile, and whether this is the first request on this action. If so, audit records the extension, the approver and the reason, sets the next follow-up date, and may ask for a milestone check. One further outcome is common and worth welcoming: audit may ask that the interim measure be added to the tracker as its own line with its own evidence, because the function intends to test it. The guide to compensating controls explains what makes an interim measure count; a measure nobody can evidence does not.
Reasons that are accepted and reasons that are not
Internal audit does not grade reasons on sympathy. It applies three tests: did the thing that changed sit outside your control, was it visible when the date was set, and did you act on it when it became visible. A vendor release that moved after the date was agreed passes all three. A dependency you never formally asked for fails the second and the third. Practitioner judgment: a reason that fails the second test, the honest “the date was never realistic”, is still better said plainly than dressed up as something else, because the auditor who sat in the closing meeting usually suspected it at the time. Say it once, build the new date properly, and the conversation moves on. Dress it up and the auditor spends the meeting testing the costume.
| Reason offered | Verdict | What audit will ask | Better framing or alternative |
|---|---|---|---|
| Vendor or IT release slipped, with written notice | Accepted, first time | Was the dependency in the original plan? What holds the risk meanwhile? | Attach the notice; split the action so the non-dependent part closes on time |
| Root cause work showed the fix is bigger than the agreed action | Accepted if the action is re-planned, not just re-dated | What is the new action, and does it address the cause? | Propose a replacement action; it is evaluated like any new response |
| Owner left; successor needs time | Accepted once, briefly | Who owns it now, in the tracker? | Name the successor in the request; keep the interim measure running |
| Budget or approval decision pending | Accepted only with a dated decision point | When is the decision, and what happens if it is no? | Give the decision date and state the risk-acceptance path if it is refused |
| Competing priorities or workload | Not accepted | Did your executive agree to deprioritize this issue? | Take the resourcing problem to your sponsor before you take a date to audit |
| “We disagree with the finding” | Not an extension | Why was this not raised at the draft stage? | Dispute it through the proper route; the action stays open until the dispute is resolved |
| Waiting on another department you have not formally asked | Not accepted | Show the request and their response | Log the dependency, obtain a written date, then ask |
| A larger program will fix this in 18 months | Not an extension | What holds the risk down for 18 months? | An interim control plus a milestoned re-plan, or a formal risk acceptance for the interval |
| Second request, same reason as the first | Rarely accepted | What did you learn from the first slip? | Re-plan from the critical path; expect the CAE to be involved |
| “The original date was never realistic” | Accepted, with a cost | Why was it agreed? | Say it once; build the new date from the work; do not agree a date in a closing meeting again without the worksheet |
How audit functions decide: the first, second and third request
Methodologies differ in detail, and the auditor-side guides on this site differ slightly among themselves on who signs the second extension, but the shape is consistent. The first extension is routine when requested before the date with evidence; it is approved above the owner, usually by the executive sponsor, and internal audit records it. The second is where the cost begins: many functions report it to the committee individually, it needs the CAE or the committee chair rather than the sponsor, and the function asks for a conversation at the next level up rather than accepting another date. The third is usually not granted as an extension at all; what remains is a re-plan with an executive’s name on the new date, or a formal risk acceptance. The escalation ladder describes the same sequence from the auditor’s side: the first missed date is a conversation with the owner; the second, or the first on a high-rated issue, goes to the owner’s manager; the third, or a high-rated issue more than 90 days past due, goes to the sponsor with three options: fund it, re-plan it or accept the risk. Its explanation of why the ladder exists is the one to remember: re-dating is painless for everyone, which is why it happens, and the ladder makes the second re-date cost something.
| Request | Typical approver | What audit expects before agreeing | How it is reported | If the new date is also missed |
|---|---|---|---|---|
| First, raised before the date | Executive sponsor; audit records | Evidence of work done; an interim measure; a date built from the remaining work | Tracker: extended once; executive’s monthly status; pack appendix in aggregate | Second missed date goes to the owner’s manager (the first does, if the issue is high-rated); a high-rated issue 90 days past due goes to the sponsor |
| First, raised after the date | Executive sponsor, after a conversation with the audit manager | The same, plus an explanation for the silence | Tracker shows overdue days and a missed date as well as the extension | Treated as a second slip |
| Second | CAE or audit committee chair, with the sponsor | A re-plan from the critical path; milestones; the sponsor’s written confirmation of resources | Reported individually in the pack as “extended twice” | No third extension; see next row |
| Third | Not granted as an extension | An executive-owned date, or a risk acceptance at the right level | Named in the pack as an exception, with the CAE’s comment | Escalation to the CEO or the committee; the rating or the report’s overall conclusion may be revisited |
| Any, on a finding issued by a regulator (a bank supervisor’s MRA, for example) | The supervisor, through the regulatory liaison function | A written request before the due date, with the reason | The supervisor’s own tracking, which has its own “past due” status | Supervisory escalation, up to formal action |
What the auditor is weighing
Behind the decision rules sit five judgments, and knowing them lets you write to them. The rating: a slip on a low-rated documentation action and one on a high-rated access action are different events, and the second is escalated by rule in many functions whatever the reason. The exposure meanwhile: an evidenced interim measure moves an auditor further than any explanation. The credibility of the new date: milestones and written dependency confirmations are believed; a round number is not. The pattern: your other open actions, your area’s history of slips, and whether the finding was a repeat. And external interest: whether the finding sits behind a SOX key control, a regulatory commitment or an external auditor’s reliance, because then the function is not the only party with a date in its diary.
Regulator-issued findings and SOX controls run on other calendars
If the action sits behind a finding issued by a regulator, the due date was committed to the supervisor and internal audit cannot extend it. Banking is the clearest example. The OCC’s policy on Matters Requiring Attention (PPM 5400-11, revised 27 August 2026 and current as of November 2026, covering the national banks, federal savings associations and federal branches and agencies of foreign banks the OCC supervises) shows how formal this is: an MRA becomes “Past Due” when the bank has not implemented the expected corrective action within the required time frame, or when examiners find at validation that it was not effective; a request for more time must be made in writing in advance of the due date; and the examiner-in-charge or assistant deputy comptroller documents the rationale for any extension granted. The OCC also expects the bank’s board to ensure timely and effective correction, so a missed MRA date is a board matter, not a line in the audit committee appendix. Federal Reserve guidance on communicating supervisory findings (SR 13-13) points the same way: an MRA that is not adequately addressed in a timely manner may be raised to a Matter Requiring Immediate Attention. (The Federal Reserve said in September 2026 that it will amend SR 13-13 to restore supervisory observations; the MRA and MRIA framework stands.) Other regulated sectors have their own equivalents, and the same rule applies: internal audit validates and reports, and the extension conversation runs through whoever owns the regulatory relationship. The guides to MRAs, MRIAs and consent orders and the lifecycle of regulatory issues cover that path for banks.
SOX adds a calendar of its own for SEC registrants. Management’s assessment of internal control over financial reporting is made as of the end of the fiscal year (Regulation S-K, Item 308), and management is not permitted to conclude that internal control is effective if one or more material weaknesses exist at that date. If your action remediates a key control and the slip carries it past year-end, the question stops being “how is this reported to the committee” and becomes “how is this deficiency evaluated at the assessment date”, which involves the external auditor and the controller’s SOX team as well as internal audit. SOX for control owners and evaluating control deficiencies cover the mechanics; the practical rule is that a slip on a SOX-relevant action is raised to the SOX program lead the same day it is raised to internal audit.
How an extension reads upward, and whose name sits next to it
Names travel differently at each level. In the tracker, the action carries your name. In your executive’s monthly status, it carries yours and theirs. In the quarterly committee pack, most functions report by role and by executive owner rather than by individual, and the pack lists the oldest and most significant open issues with their owners and status. So the question “will my name be in front of the audit committee” usually has the answer “no, but your executive’s will be, next to a line you wrote”. That is the lever. Internal audit drafts the one-line status in the pack from your updates, and will almost always accept a factual line you supply.
Write the line yourself and send it with the request. “Action 2.1 extended once to 31 August (approved COO, 2 March): vendor moved the connector to the June release; standing admin access removed 12 March; interim manual review operating since 15 March.” A committee member who reads that reads control. The alternative, “overdue since 31 March; revised date under discussion”, is what gets written when the owner leaves the drafting to the function. The audit manager reads the first as routine and the second as a pattern to raise with your sponsor; your sponsor can defend the first upward in one sentence and the second not at all; the executive committee, which in many functions sees a named list of high-rated actions overdue past about 30 days, never sees the first line. The guide to the CFO and internal audit describes the partnership in which the finance executive holds owners to their action plans; an executive in that position would far rather defend a dated extension than an undated overdue.
When the action will never be done: the risk-acceptance alternative
Some actions are not going to happen: the system is being decommissioned, the fix costs more than the exposure, the business has changed under the finding, or the action was agreed in a closing meeting by someone who has since left. The dishonest path is the serial extension, six months at a time, each approved by a sponsor who has stopped reading. The honest path is one of three instruments. A replacement action addresses the same risk by a different route, with a new date, and is evaluated like any new response. A dated deferral is still an action plan: the guide to risk acceptance by management is explicit that deferral is a decision to fix the cause later and therefore carries a date and an interim measure, not an acceptance signature. And formal risk acceptance is a decision by someone with the authority to carry the exposure, recorded with the grounds, the options rejected and a review date, which the CAE assesses; under Standard 11.5, if the CAE concludes that the accepted risk exceeds the organization’s risk appetite or tolerance, the CAE must discuss it with senior management and, if the matter is not resolved, escalate it to the board.
The Standards leave no fourth state. Standard 15.2 requires internal auditors to confirm that action plans have been implemented and, when management has not progressed against the established completion dates, to obtain and document management’s explanation and discuss it with the CAE, who then decides whether senior management has, by delay or inaction, accepted a risk that exceeds the organization’s tolerance. That is why the auditor asks for a written reason the week a date passes. An action on its fourth extension, with no interim measure and no decision, is neither implemented nor accepted; it is an exposure nobody has decided to carry, which the risk-acceptance guide calls the opposite of acceptance. Owners sometimes resist acceptance because it feels like admitting defeat. From the audit side it reads as the reverse: the owner who says “this will not be done, here is why, and here is who is accepting the residual risk” has made a decision; the owner on a fourth extension has avoided one. Regulatory and legal obligations, and safety or customer-harm risks above a low threshold, cannot be accepted by management at all; they go to the board if they go anywhere.
| Situation | Right instrument | Who decides | What the tracker shows | What internal audit does |
|---|---|---|---|---|
| Fix is on track but later than planned | Extension | Sponsor (first); CAE or chair (second) | Extended once or twice; original date preserved | Records it; follows up on milestones |
| The cause turned out to be different or bigger | Replacement action | Owner and sponsor, agreed with audit | Original action closed as superseded; new action with its own date | Evaluates the new action as a new response |
| Fix waits on a dated system change, such as a decommissioning in 14 months | Dated deferral with an interim measure | Sponsor, with the CAE’s view | Open, long-dated, with milestones and an interim line | Tests the interim measure; checks the milestone dates |
| Fix is not worth doing and the exposure sits within appetite | Formal risk acceptance | The authority ladder by rating; the CAE’s view; board if beyond appetite | Risk accepted, with a review date; still visible | Assesses under Standard 11.5; escalates if it exceeds appetite and is unresolved |
| Regulatory, legal, safety or customer-harm matter | None of the above; the action is done or escalated | Board, if anyone | Open until implemented | Escalates |
| Nobody owns it and nobody decides | None; the worst state | Nobody | Overdue and aging | Walks it up the escalation ladder |
Re-planning from the critical path, not from hope
Most second extensions trace back to a first re-plan done the way the original date was: by choosing a date that sounded responsible. Build the new date from the work instead. List the remaining work packages as deliverables. Take durations from your own history: how long the last comparable change actually took from delivery to go-live. Put every dependency in writing with a date from the person who owns it. Add the operating period validators will need before they can test the control, and agree it with the audit manager in the request rather than assuming it; the guides to evidence standards for issue closure and sustainability testing explain why a control that has run once is not closable and give the usual minimums: a month to a quarter for a daily control, a quarter for a weekly one, three cycles for a monthly one, two for a quarterly one, one review cycle for an access review, and two quarter-ends where the finding is high-rated. Add the time to assemble the evidence pack and the function’s validation lead time, about a month where a service standard exists. Then add buffer in proportion to the number of parties involved, and call it buffer rather than hiding it inside a duration.
Practitioner rule: the date to commit is the one that still holds if your largest single dependency slips by three weeks. If that date looks embarrassingly far away, the right response is to split the action and close the part you control on time, not to shave the date back toward the one you just missed.
| Step | Question | Northgate’s answer for action 2.1 |
|---|---|---|
| 1. Remaining work packages | What is left, stated as deliverables? | Connector installed; configuration and testing complete; first automated review run; evidence pack assembled |
| 2. Durations from history | How long did comparable work take last time, actually? | The last IAM connector took five weeks from delivery to go-live; the plan had said three |
| 3. Dependencies in writing | Who outside the team must do what, by when, confirmed how? | Vendor delivers 12 June (release notice); IAM lead commits two person-weeks in June (email) |
| 4. The independent part | What can finish regardless of the dependency? | Removal of standing admin access, done by 31 March as action 2.1a |
| 5. Operating period | How many cycles must the new control run before validation, and has audit agreed? | One automated cycle (the July review), agreed in writing with the audit manager because the manual interim reviews of March and June supply two more cycles of evidence; without that agreement, two automated cycles and a 30 November date |
| 6. Submission and validation lead | When is the evidence ready, and how long does audit take? | Submit 13 August; validation about a month |
| 7. Buffer | What can slip three weeks without breaking the date? | The vendor release; buffer sits between delivery and the July review |
| 8. Milestones | What can audit check between now and the date? | 12 June; 2 July; 31 July; 13 August |
| 9. Committed date | Last work package plus operating period plus submission | 31 August 2027 |
| 10. Re-plan trigger | What slip forces a second request, and when would you know? | Connector not delivered by 30 June, known on 1 July, raised the same day |
Interim mitigation that buys credibility
An interim measure is the difference between “the risk has been unmanaged for five extra months” and “the risk has been held down by a manual control while the permanent fix is built”, and it is the single element of the request that moves auditors most. It is also tested, so it has to be real: an owner, a start date, evidence that it operated, and an end condition stated in advance, such as “until the first automated review cycle has been validated”. The guide to preventive, detective and corrective controls matters here: an interim measure is almost always detective (a review of what happened) standing in for a preventive control that is not built yet, and it should be described that way rather than as a substitute of equal strength.
| Finding type | Interim measure | Evidence to keep | End condition |
|---|---|---|---|
| Privileged access not reviewed | Manual quarterly review from a system user export; standing admin access removed now | Dated export; reviewer sign-off; removal tickets | First automated review cycle validated |
| Segregation-of-duties conflict | Weekly detective review of transactions posted by conflicted users | Report, reviewer initials and date, exceptions log | Role redesign live and one cycle tested |
| Reconciliation not performed or not reviewed | Manual reconciliation with secondary review; aged items escalated monthly | Reconciliation file; review evidence; aged-item list | Automated reconciliation live for three monthly cycles |
| Vendor due diligence gaps | Enhanced monitoring of the highest-exposure vendors; no new onboarding without the missing check | Monitoring log; onboarding checklist | New onboarding process operating |
| Policy outdated or training not delivered | Interim memo of required practice with staff attestation | Memo; attestation list | Policy approved and training completed |
| Automated control not operating | Manual check of every item above a threshold, or of a sample below it | Check log with dates and initials | Fix deployed and tested |
| Change management bypass | Second approver on emergency changes; weekly review of all changes | Approvals; review log | Tool-enforced workflow live |
| Payment approvals above threshold | Temporary dual approval or lowered thresholds | Approval records | Workflow control live |
Worked example: Northgate Logistics and the connector that moved
Northgate Logistics is a hypothetical regional distribution company. Its December 2026 audit of warehouse systems access produced one high-rated finding: privileged access to the warehouse management system was never reviewed, and eleven accounts held standing administrator rights. The agreed action, 2.1, was to remove standing admin access and implement a quarterly automated privileged-access review through the identity management tool, with a target date of 31 March 2027. The owner is Priya Raman, director of warehouse systems; the executive sponsor is the COO. The date was set in the closing meeting on the strength of a vendor roadmap that put the identity tool’s connector for the warehouse system in the March release.
On 18 February the vendor’s release notice moved the connector to June. At her weekly look-ahead on 19 February, Raman laid out the remaining work against the new vendor date and found no path to 31 March. Over the next two working days she did three things. She split the action with the audit manager’s agreement: 2.1a, remove standing admin access, keeps the 31 March date because it depends on nobody outside her team; 2.1b, the automated review, takes the extension. She scheduled a manual quarterly review from a system user export for 15 March as the interim measure, with herself as reviewer and the security lead as second reviewer, to repeat in June and run until the automated review was validated. And she drafted the one-page request from the re-planning worksheet above, with 31 August as the date, which includes the July review cycle and two weeks of buffer against the vendor; the audit manager confirmed in writing that one automated cycle on top of the two manual reviews would be enough to validate. The COO approved the first extension on 2 March; audit recorded it the same day.
| Date | Event | What the tracker shows | What goes upward |
|---|---|---|---|
| 10 Dec 2026 | Final report issued; action 2.1 due 31 Mar 2027; owner Raman; sponsor COO | Open; original and current date 31 Mar | Report distribution |
| 12 Jan 2027 | First status update: connector expected in the March release | In progress | Executive monthly status: on track |
| 18–19 Feb | Vendor notice moves the connector to June; weekly look-ahead finds no feasible path to 31 Mar | No change yet | Sponsor briefed by phone |
| 23 Feb | Action split into 2.1a and 2.1b; interim review scheduled; request sent | 2.1a due 31 Mar; 2.1b extension requested | Request copied to the COO |
| 2 Mar | COO approves extension 1 | 2.1b current date 31 Aug; original 31 Mar; count 1; approver COO; reason and interim line recorded | Executive monthly status: amber, with the one-line reason |
| 12–15 Mar | Standing admin access removed from all eleven accounts; interim manual review performed and signed off | 2.1a submitted for validation; interim measure evidenced | Nothing additional |
| April | First-quarter committee pack | Appendix: 2.1b extended once, approved by the COO, interim measure in place; 2.1a validated and closed | No question from the committee; the row is in aggregate |
| 12 Jun | Connector delivered on the vendor’s date | Milestone met | Nothing additional |
| 15 Jun | Second interim manual review performed and signed off | Interim measure evidenced for a second quarter | Nothing additional |
| 25 Jun | Configuration slips one week; absorbed by buffer | Milestone adjusted inside the plan; committed date unchanged | Executive monthly status: amber, on track |
| 31 Jul | First automated quarterly review completed | Milestone met | Nothing additional |
| 13 Aug | Evidence pack submitted | 2.1b submitted for validation; clock stopped | Executive monthly status: complete, pending validation |
| 9 Sep | Validation passed | Closed | Third-quarter pack: closed and validated |
Now run the counterfactual; the work is identical and only the handling differs. Suppose Raman had said nothing and waited for the connector. Internal audit’s follow-up reminder lands on 7 April and the tracker reads “overdue 7 days, no revised plan”. Because the issue is high-rated, the audit manager calls her manager that week. By early May a high-rated action overdue more than 30 days is on the executive committee’s list with the COO’s name against it, and the COO is hearing about the vendor notice of 18 February for the first time, eleven weeks late. The July committee pack carries a high-rated issue overdue one full quarter, exactly at the boundary of the healthy reading the committee has been given, with audit’s note that the owner did not report the slip until contacted. The connector still arrives on 12 June, the control still goes live in July, the evidence is still submitted in August. Same work, same finish, and a reputation that follows her into the next audit of her area, where the planning memo cites a history of overdue actions as a risk factor. The eleven standing admin accounts, meanwhile, sit unreviewed from December to July, because the manual interim review existed only in the version where she raised it.
Avoiding the second one
Prevention is mostly a weekly habit layered on decisions made when the action was first written. The two that matter most are structural: date only what you control, splitting anything that depends on another team or a vendor into its own action with its own date, and give any long action milestones, so that a slip shows up as a missed milestone with months to recover rather than as a missed date with none (the action-plans guide draws the line at six months; for anything with an outside dependency, draw it at three). The rest is routine, and the table below is the routine. The guide to living with internal audit year-round covers the standing relationship that makes all of it easier; control ownership covers backup owners and the handover rule, which is what keeps an action alive when its owner leaves.
| Practice | When | What it prevents |
|---|---|---|
| Date only what you control; split dependent and independent work into separate actions | When the response is drafted | A whole finding held hostage to one vendor release |
| Dependency log with written confirmations and dates | At drafting; reviewed weekly | “Waiting on IT” with nothing to show for it |
| 30-day look-ahead for every open action | Weekly, at the remediation meeting | Discovering the slip on the due date |
| Milestones on any action longer than about three months, or six with no outside dependency | At drafting | Silent drift; gives audit something to check between dates |
| Operating period and validation lead built into the date | At drafting | “Done” on the date but not closable for three months |
| Evidence binder kept from day one | Continuously | Validation failure, which converts a kept date into a reopened issue |
| Status update sent before audit’s follow-up date | Monthly, or per the tracker’s next follow-up date | The “unresponsive” note in the file |
| Named backup owner for every action | At drafting | An action that dies when its owner leaves |
| Re-plan trigger: any milestone slip over two weeks forces a full re-plan and a decision within five working days | Per milestone | A second extension reached by drift rather than decision |
| The one-free-extension rule | Always | Spending the cheap extension on something avoidable, and paying full price for the one you needed |
One last point of judgment. Owners sometimes treat the first extension as a stain and fight to avoid it by promising a date they cannot keep, which produces the second extension they were trying to avoid. The audit function reads a single, early, evidenced extension as an owner who tracks the plan, the second as a question about the owner, and the third as a question about the executive. Spend the first one well. This guide is general and educational; it is not legal or employment advice.
Questions readers ask
How do I ask for an extension on an audit finding?
In writing, before the due date, to internal audit’s issue coordinator with your executive sponsor copied. State the original date, the proposed new date, what is done with evidence attached, what remains as work packages with durations, the single thing that changed since the date was set, the interim measure holding the risk down, and the sponsor’s approval. One page, with the evidence attached rather than offered.
What happens if an audit action is overdue?
The tracker records a missed date and starts counting days past the current target date, and internal audit follows up for a new date and a reason. In many functions a high-rated action that is overdue by about a month reaches the executive committee by name, and one overdue by about two months, or more than a quarter, is reported to the audit committee. Overdue actions also feed the metrics the committee watches: the share overdue, the oldest open high-rated issue, and remediation by executive owner.
How many times can an audit action be extended?
There is no universal limit, but the common practice is that the first extension is routine if requested before the date with evidence, the second needs the CAE or the committee chair and is reported to the committee individually, and a third is not granted as an extension. At that point the action is either re-planned with an executive’s name on the new date or the residual risk is formally accepted at the appropriate level.
Who approves an extension to an audit action plan?
Someone above the owner, never the owner. In most methodologies the executive sponsor approves the first extension and internal audit records it; the second goes to the chief audit executive or the audit committee chair. For findings issued by a regulator, such as a bank supervisor’s MRA, the due date was committed to the supervisor, and only the supervisor can change it, through whoever owns the regulatory relationship.
Does an extension get reported to the audit committee?
A first extension usually appears only in aggregate, in an appendix or a count, with the approver recorded. A second or later extension is typically reported individually, and the committee is specifically asked to watch the number of issues extended more than once and whether extensions were approved above the owner. Most committee packs report by executive owner and role rather than by individual, so your executive’s name travels further than yours.
The fix is done but internal audit has not validated it yet. Is the action overdue?
In many functions, not if you submitted the evidence before the due date: the action moves to a state such as “submitted for validation” and the time audit takes to test it is audit’s lead time, not your overdue days. Check how your tracker records that state. If the control has gone live but has not yet operated long enough to be tested, that is a planning error in the original date rather than an extension problem; ask for validation to be scheduled after the operating period and say so plainly.
Should I request an extension or ask for the risk to be accepted?
Request an extension when the fix is coming and you can name the date from the remaining work. Ask for a replacement action when the cause turned out to be different. Ask for formal risk acceptance when the action is not going to be done at all, because the cost exceeds the exposure or the business has changed, and someone with authority is prepared to say so on the record with a review date. A fourth extension on an action nobody intends to complete is the one choice that serves nobody.
Related guides
- Being Audited? hub — every guide for the person on the receiving end of an audit, in the order the audit happens.
- Writing Management Action Plans That Actually Close — how to set the date in the first place, with the ownable-commitment test and typical timelines by action type.
- Remediating Audit Findings: The 90-Day Plan — the weekly rhythm, the dependency log and the 30-day look-ahead this guide relies on.
- How to Get an Audit Finding Closed — the closure request and evidence pack that stop the clock before the date.
- Audit Issue Tracking: Data Model, Workflow, Metrics — why the original date is never overwritten and how extension counts are governed.
- Reporting to the Audit Committee: The Quarterly Pack — the overdue and extension metrics the committee reads, with healthy and warning readings.
- The Escalation Ladder — what internal audit does at the first, second and third missed date.
- Risk Acceptance by Management — the authority ladder, the acceptance record and Standard 11.5.
- Evidence Standards for Issue Closure — what validators need and why the operating period belongs in your date.
- Sustainability Testing — the operating period a fix needs before closure, by control type.
- Compensating Controls: When Plan B Is Good Enough — what makes an interim measure count.
- MRAs, MRIAs and Consent Orders Explained — why regulator-issued dates are a different conversation.
- SOX for Control Owners — what a slip past year-end means for a key control.
- Living With Internal Audit Year-Round — the standing relationship that makes a hard conversation easy.
Leave a Reply