Breaking the Cycle: Why Audit Findings Persist and How Internal Audit Can Drive Lasting Change

The Frustration of Recurring Findings: A Systemic Problem

Internal audit professionals frequently encounter the disheartening reality of recurring audit findings. Despite management's commitments to remediation, the same weaknesses resurface year after year, draining resources and undermining the audit function's effectiveness. This persistence isn't merely a series of individual control failures; it points to a more profound issue within the organization's enterprise governance framework. Often, this framework is either inadequate, outdated, or disconnected from the actual operational realities, creating an environment where weaknesses can take root and flourish.

Unpacking the Root Causes: Accountability, Culture, and Design

The article identifies three primary root causes for recurring findings:

• Accountability Gaps: When there are no tangible consequences for control failures, such as starting work without signed contracts or inadequate vendor bank account verification, the business pressure to bypass processes often outweighs adherence to controls. This lack of accountability means that even critical issues, like those leading to payment fraud, continue unabated because no one directly experiences repercussions.
• Culture and Hierarchy: Organizational culture, particularly when seniority overrides established processes, significantly contributes to recurring findings. Examples include change management processes being bypassed due to business deadlines or senior management signing off on inadequate testing. Similarly, segregation of duties (SOD) reviews often fail to keep pace with dynamic business events, and management may opt for compensating controls rather than addressing root causes, especially when senior personnel are involved.
• Control Design Flaws: Many controls are simply not designed for the modern, fast-paced business environment. Persistent issues like access control, where privileged access remains unrevoked, or vendor vetting processes that lack continuous reassessment, highlight this. The emergence of "shadow AI" and unmanaged vendor AI risks further exemplifies design weaknesses, as traditional risk management frameworks are ill-equipped to handle these new complexities, leading to significant governance gaps and potential data breaches.

Driving Lasting Remediation: Beyond Documentation

To break the cycle of recurring findings, internal audit must shift its focus from merely documenting symptoms to addressing the underlying systemic issues. The article suggests three critical drivers for effective remediation:

• Consequences: Implementing clear and consistent consequences for control failures, scrutinized by the audit committee, can significantly alter behavior.
• Continuous Monitoring: Moving from periodic to continuous monitoring for areas like access reviews, SOD, vendor assessments, and AI usage is essential, leveraging existing tools to provide real-time visibility in dynamic environments.
• Connecting to Business Objectives: Framing audit findings in terms of business risk, regulatory exposure, or financial impact elevates their importance, ensuring they are heard and acted upon by management.

By uncovering these deeper reasons and advocating for solutions that target the system rather than just the symptom, internal audit can fulfill its mandate to enhance organizational governance and deliver greater value, aligning with the IIA's Global Internal Audit Standards' emphasis on outcomes and impact.