Conceptual illustration by Touch Stone Publishers. The bridge represents the distinction between implementing a correction and supporting the closure decision; it is not an engineering example or an assurance guarantee.

By Glenn E. Daniels II

An audit action is ready to close when the evidence supports the decision being made. A completed task is part of that evidence. It does not, by itself, establish that the original weakness has been addressed.

For an audit committee chair, the practical question is straightforward: what must management and internal audit be able to show before a significant finding disappears from active attention? The answer should be settled while the action is being designed. Waiting until the deadline turns an evidence question into a negotiation over a status label.

Touch Stone's recommendation is to distinguish implementation, verification and risk acceptance in the closure record. These are different conclusions with different owners. Keeping them visible gives the committee a firmer basis for deciding where its attention is still needed.

A completion deadline can quietly become the acceptance test

Consider an illustrative purchasing-control failure. The same employee can create a supplier and approve a payment. Management agrees to change permissions. The technology team installs the change before the next committee meeting. Its ticket is closed, and the corrective action is marked complete.

The installation may be real and useful. Yet the original concern was unauthorized payment, not the absence of a software change. An emergency-access account might still permit both activities. A manual payment route might sit outside the updated system. Or the change might work exactly as intended. The installation record alone cannot distinguish those possibilities.

This is how a reasonable reporting process can produce an unreasonable inference. Project teams report against deliverables they control. Committees receive summaries designed to show movement. If the tracker contains one completion field, both groups can use the same word while answering different questions.

No dishonesty is necessary. The mechanism is compression: a statement about work performed becomes a statement about the confidence leaders should place in the resulting control. Once the item leaves the report, the unresolved question can leave the agenda with it.

Follow-up should reflect the finding's significance

The Institute of Internal Auditors' final 2024 Global Internal Audit Standards took effect on January 9, 2025. Standard 15.2 requires an established method for confirming implementation, including progress inquiries, follow-up assessed according to risk, and tracking updates. The significance of the finding determines the extent of those procedures. Its implementation considerations allow selective follow-up of completed plans according to risk significance. The IIA, Global Internal Audit Standards, January 9, 2024, Standard 15.2, pages 114-115.

That distinction matters. It would be a mistake to turn this argument into a demand for a fresh audit of every completed action. A corrected reference in a procedure and a redesigned payment authorization control do not warrant the same work. The governing discipline is to match the evidence to the consequence of being wrong.

Management should know the proposed evidence requirement before committing to a date. Internal audit should identify the follow-up needed under its methodology and explain any material limitations. The committee should understand what the resulting conclusion will establish. That conversation can prevent both premature closure and an expensive verification exercise that adds little confidence.

Three conclusions deserve separate records

The following is Touch Stone's recommended reporting distinction, not a status taxonomy prescribed by the IIA.

Touch Stone editorial synthesis. The three explanations below provide the complete text equivalent. Risk acceptance is separate from verification, not a later step or evidence that remediation worked.

Implemented means the agreed change has been put into effect within its stated scope. Record who owns it, what changed and when. For the purchasing example, that includes the affected systems and roles. If the action excludes emergency access, the record should say so.

Verified within scope means the designated reviewer has enough evidence, under the applicable risk-based method, to support the stated closure conclusion. Record the method, observation period, result and limits. Depending on the finding, evidence might include configuration inspection, a walkthrough, selected transactions or observation across an operating cycle. A reviewer's name without the basis of the conclusion leaves the next reader dependent on personal reassurance.

Risk accepted means an authorized person or body has expressly decided to retain a stated exposure. Record the authority, rationale, conditions and review date. Risk acceptance does not establish that remediation worked. Nor does it erase any obligation that cannot be waived by an internal decision. A lawful, properly authorized acceptance can be a legitimate disposition; it should remain distinguishable from a verified correction.

An action can therefore be implemented while verification remains open. A finding can also have a documented disposition that involves continuing risk. A tracker may use other labels, but its board report should preserve these differences. The objective is a faithful account of the decision, not a new vocabulary project.

The purchasing example turns on a bounded conclusion

Return to the illustrative permissions change. The process owner identifies the supplier-creation and payment-approval routes, including emergency access and manual payments. Internal audit selects follow-up consistent with the finding's significance. The reviewer examines the changed permissions and relevant evidence from transactions or tests, documenting why that evidence is sufficient for this particular conclusion.

Suppose the standard workflow prevents the conflicting access, but an emergency account remains outside the change. The useful report separates what is known from what remains unresolved. It identifies the verified workflow, the excluded route, the person responsible for the remaining exposure and the next decision date. If an interim control is proposed, its operation also needs support proportionate to the risk being addressed.

The committee can then challenge a concrete judgment. Is the scope sufficient? Does the excluded route undermine the conclusion? Does the remaining exposure require escalation? It does not need to reconstruct every transaction to see whether the closure decision is credible.

A later incident would not automatically prove that the earlier review was careless. Controls provide bounded confidence, not a promise that failure is impossible. Equally, the absence of an incident does not establish that a control worked. The record should let a successor understand what was examined and what conclusion was justified at the time.

Oversight depends on assurance without absorbing management's work

This is where Touch Stone's Governance Boundary Principle applies: management carries out the corrective action; the board governs the expectations and challenges the assurance on which it relies. Internal audit's role follows its mandate and professional methodology. A committee chair should not become the organization's permission administrator or transaction tester.

There is a useful parallel in the Financial Reporting Council's January 2026 Provision 29 Mythbuster. For companies reporting against the UK Corporate Governance Code, the FRC emphasizes a proportionate approach and says external assurance is not a requirement of the Code. The appropriate assurance arrangements depend on the company. That is UK guidance for its own scope, not a universal rule for all boards. FRC, Provision 29 Mythbuster, January 29, 2026.

The practical implication is to ask for an intelligible basis of confidence. Who supplied the evidence? Who evaluated it? What conflict or limitation could weaken the conclusion? A significant finding may justify a more independent or specialized assessment. It does not follow that every closure needs an outside firm or that directors must personally retest every control.

More verification can become its own failure

The strongest objection is operational. If closure requires elaborate proof for every small issue, a company can spend more on demonstrating progress than on reducing risk. Review backlogs can obscure the few findings that most need attention. Managers may also learn to negotiate softer actions because ambitious improvements become harder to close.

That objection should shape the method. Agree risk tiers, evidence expectations and escalation rules before the work begins. Permit proportionate review. Keep low-risk administrative corrections from consuming the attention needed for consequential weaknesses. Explain why the chosen method is sufficient, including when it relies on evidence already produced in normal operations.

A second objection concerns timing. Some controls operate annually or only after an unusual trigger. Waiting for a full cycle may be appropriate, but it can leave a long gap between installation and observation. Record that gap. A walkthrough or simulation may support an interim conclusion if suitable for the finding; it should not be represented as months of observed operating performance.

These limits make the recommendation more useful. Honest uncertainty gives leaders something they can manage. A prematurely final status removes the uncertainty from view without necessarily reducing it.

Set the closure rule before the next deadline

For the next audit committee cycle, Touch Stone recommends that the chief audit executive and the responsible management executive bring a small, risk-selected set of recently closed significant findings. The chair should request the original weakness, agreed action, evidence basis, conclusion and any continuing exposure for each.

Use that review to identify where the present method is unclear. Before the following cycle, assign an owner to clarify the closure criteria and the handling of unresolved exceptions. Judge the improvement by whether each selected conclusion can be traced to sufficient evidence and authorized disposition. Treat missing evidence as unresolved, even when the action met its original deadline.

The goal is not a permanently longer report. It is a reliable handoff of institutional judgment. Successors should inherit the reason an issue was closed and the conditions that could require it to be reopened. Build that practice while there is time to think, before a failure dictates the questions.

For continuing Board Reviews on management evidence, unresolved exposure and decisions that need follow-up, explore Touch Stone Executive Intelligence Membership.

Close the action when the evidence earns the conclusion.