Blog · Board and management reporting · Compliance
How a compliance or internal audit team reports the findings that are open past their agreed remediation date, from the issue register: ageing bands per owner and business unit, the extensions granted and how many times, the high-rated issues past date, and the trend that shows a remediation programme slipping before the board asks why the same finding is on the pack for the third quarter.
A finding raised in March with a June remediation date is on the September board pack, and the October one, with its date moved each time. The issue register holds every date it has had. This guide sets out ageing per owner and unit, the extension count, the high-rated list, and the trend.
Per open finding:
Days past current date = today − current remediation date, if positive Days past original date = today − original remediation date, if positive Extensions = count of remediation date changes
Per owner, per business unit, per quarter:
Open findings, past date, share past date, high-rated past date, average extensions
Owner identifiers only.
findings = open on time + open past date + closed evidenced + closed unevidenced
Every finding in exactly one state. A finding with status open and a closure date, or closed with none, fails it and is listed.
| Finding | Rating | Owner | Unit | Original date | Current date | Days past original | Extensions |
|---|---|---|---|---|---|---|---|
| F-0412 | High | O-07 | Payments | 30 Jun | 31 Dec | 78 | 3 |
| F-0088 | High | O-12 | Lending | 31 Jul | 31 Jul | 47 | 0 |
| F-0231 | Medium | O-07 | Payments | 31 May | 30 Sep | 108 | 2 |
| F-0177 | High | O-03 | Treasury | 31 Aug | 31 Aug | 16 | 0 |
Finding F-0412 has been extended three times and is now due six months after it was first promised. Finding F-0088 is simply late, with no extension requested, which is a different failure. Owner O-07 has two findings on the list and five extensions between them.
| Unit | Open | Past current date | Past original date | High past date | Avg extensions |
|---|---|---|---|---|---|
| Payments | 24 | 6 | 11 | 3 | 1.4 |
| Lending | 31 | 4 | 5 | 1 | 0.3 |
| Treasury | 12 | 1 | 1 | 1 | 0.1 |
Payments has nearly half its open findings past the date originally agreed, and the extension average says how. The trend over four quarters says whether that is new.
Only the current date tracked. Every extension resets the clock and nothing is ever overdue.
Rating ignored in the ranking. Ten low-rated findings above one high-rated one.
Closed unevidenced counted as closed. It reopens at the next audit and the trend looks better than it is.
Owner not an individual. A unit as owner means nobody, and the extension count has no one to attach to.
Mapped once, the issue register produces ageing per finding, per owner and per unit, the extension counts, the high-rated list and the trend every month. Covirage builds this from the export as it is. The compliance page describes the setup, and the testing cadence guide covers the companion measure on the control side.
The date the issue owner agreed to have the finding closed, recorded at the time the finding was raised or the action plan accepted. Where it has been moved, the original date and each subsequent one are kept, so the extension count is computable.
Both are on the report. Days past the current date is what the owner is measured against. Days past the original date, with the extension count, is what the audit committee should see, because it is the one that shows a finding being pushed along a quarter at a time.
A closed finding has a closure date and a closure evidence reference in the register. A finding marked closed with no evidence reference is listed as closed unevidenced, separately, because it will be reopened at the next audit.