Issue ageing

Days an open finding is past its remediation date, against both the current date and the original one, with the count of extensions. Per owner and unit, ranked by rating. Three extensions on one finding is a finding about the owner.

DefinitionDays an open finding is past its remediation date, against both the current date and the original one, with the count of extensions. Per owner and unit, ranked by rating. Three extensions on one finding is a finding about the owner.

Both dates

Days past the current date is what the owner is measured against. Days past the original, with extensions, is what the audit committee should see.

Closed unevidenced

A closure with no evidence reference is its own state, because it will reopen.

How it is computed

Days each open finding is past its remediation date, against both the current date and the date originally agreed, with extensions counted, by owner.

Example

One owner has seven open issues, five overdue, with a median of 140 days past the original date and eleven extensions between them.

Where it goes wrong

Aged against the latest date only. Every extension resets the clock and the list looks healthy.

Articles that use this term

Coverage and territory · Compliance

Incident reporting against activity: the unit that reports nothing is not the safest one

How a compliance team reads its incident and near-miss reports against the activity that produces them, from the incident register and the activity data: reports per unit of activity, transactions, trades, accounts opened, the units well below the firm's own rate, the rate against the unit's audit findings, why a low reporting rate with high findings is a culture measure, and the list of units where the register is quiet and the evidence is not.

16 Sept 20262 min read Board and management reporting · Compliance

Issue ageing by owner: open findings past their remediation date

How a compliance or internal audit team reports the findings that are open past their agreed remediation date, from the issue register: ageing bands per owner and business unit, the extensions granted and how many times, the high-rated issues past date, and the trend that shows a remediation programme slipping before the board asks why the same finding is on the pack for the third quarter.

16 Sept 20263 min read Coverage and territory · Compliance

Ten questions a head of compliance asks, and the table that answers each

The ten questions a head of compliance puts to the business units and the compliance team, which obligations have no control, which controls were not tested on schedule, which findings are past their date and how many times extended, which regulatory changes have no mapping yet, who is overdue on training, which units report nothing, which high-rated issues are open, what will a regulator find first, what did the last audit find that the register did not, and what changed, each with the table from the registers, the identity behind it, and the answer to send back.

16 Sept 20262 min read Alternatives and comparisons · Compliance

How to choose analytics software for compliance: questions, data and traps

How compliance teams should choose analytics software: start from the questions, check the data you hold, ask vendors ten questions, avoid the traps.

24 Sept 20264 min read Board and management reporting · Compliance

KPIs for compliance teams: ten measures that matter, each with its formula and the export it comes from

The ten KPIs a compliance function should run on, each with its formula, the export it comes from and what it tells you: obligation to control coverage, regulatory change coverage, control testing on schedule, test failure rate and repeat failures, issue ageing by owner, training completion against role requirement, incident reporting against activity, policy attestation, time to close findings, and evidence completeness. Also the three measures most compliance teams miss, the figures to drop, the identities, and who owns what.

17 Sept 20264 min read