The Audit Findings Tracker: A Template for Following Up Audit Recommendations
An audit findings tracker template, the statuses from agreed to verified, what Standard 15.2 asks, and the follow-up deadlines in Kenya, Ghana and nearby.
Short answer: An audit findings tracker records each finding, its recommendation, management's agreed action with an owner and a due date, and the action's status until someone independent of the owner confirms it is done. The IIA's Standard 15.2 expects internal audit to confirm that recommendations or action plans are implemented, and audit committees expect a list of what is still open and overdue.
This guide is for heads of internal audit, audit managers and audit committee secretaries in ministries, counties, municipalities, state corporations, banks and listed companies who follow up recommendations in a spreadsheet. It gives you a tracker template you can copy, the statuses an action should move through, the control points that keep the tracker honest, and the follow-up duties set in several African markets.
Creodata sells audit management software, including internal audit management software, so we say plainly where it fits near the end. The template works with or without any software. This is practical guidance, not professional advice: your internal audit charter, methodology and the rules of your sector decide what applies to you.
Why follow-up needs its own record
A finding that is reported and never followed up has achieved very little. Most functions know this, and most still keep follow-up in a spreadsheet updated before each audit committee meeting. The trouble is that the spreadsheet is usually rebuilt from last year's reports, the owners' replies sit in email, and the evidence that an action was completed is wherever the auditor saved it.
A tracker kept as its own record fixes three things:
- Accountability. Each action has a named owner and a due date, so "overdue" is a fact.
- Independence. The person who says an action is implemented is not the person who confirms it.
- Reporting. The audit committee's question, "what is still open?", is answered from the tracker, not from a trawl through old reports.
What the Global Internal Audit Standards ask
The IIA's Global Internal Audit Standards took effect on 9 January 2025. Two standards frame follow-up.
Standard 14.4, Recommendations and Action Plans, is where the tracker starts: every recommendation is matched by an action plan, with an owner and a date.
Standard 15.2, Confirming the Implementation of Recommendations or Action Plans, asks internal auditors to confirm that management has implemented its recommendations or action plans: to inquire about progress, and to follow up on a risk basis. A tracker that records each follow-up with its date, and who confirmed the result, is the evidence of that work.
For a wider view of which standards software can help evidence, see our guide to the Global Internal Audit Standards 2024, standard by standard.
An audit findings tracker template
Copy this table into your own tracker. The example rows are illustrative; replace them with your engagements' findings.
| Ref | Engagement and report date | Finding | Severity | Recommendation | Management's response | Agreed action | Owner | Due date | Status | Last follow-up (date, by whom, what was seen) | Verified by and date |
|---|---|---|---|---|---|---|---|---|---|---|---|
| F-01 | Procurement audit, report 14 March | Supplier master file changes not reviewed | High | Review supplier master changes monthly, with sign-off | Agreed | Monthly review report signed by the Head of Finance | Head of Finance | 30 June | Implemented | 2 July, lead auditor: three signed monthly reviews received | Pending |
| F-02 | Procurement audit, report 14 March | Tender committee minutes not signed | Medium | Sign and file minutes within five working days of each meeting | Agreed, with a revised date | Signed minutes filed for every meeting | Secretary, Tender Committee | 31 May, revised to 31 July | In progress | 3 June, audit manager: two of four sets signed | |
| F-03 | Payroll audit, report 2 April | No reconciliation of payroll to HR records | High | Reconcile monthly | Risk accepted until the new HR system goes live | None; risk acceptance noted by the Accounting Officer | Accounting Officer | Risk accepted | 15 April: acceptance note filed |
Two columns carry most of the weight:
- Last follow-up says what was actually seen, not only what the owner said. "Owner says done" is a status update; "three signed reviews received" is evidence.
- Verified by is someone other than the person who reported the action implemented. Without that column, the tracker is a list of claims.
The statuses an action moves through
Keep the list short and the meaning of each status fixed:
| Status | Meaning | Who sets it |
|---|---|---|
| Agreed | Management has accepted the recommendation and an action, owner and due date are recorded | The auditor, from management's response |
| In progress | Work has started; the owner has given an update | The auditor, at follow-up |
| Implemented | The owner reports the action complete, with evidence | The auditor, recording the owner's report |
| Verified | Someone independent of the person who recorded it implemented has seen the evidence and confirms it | A second auditor or the audit manager |
| Risk accepted | Management has chosen not to act and accepts the risk; the acceptance is written and attributed | The auditor, with the acceptance note filed |
"Overdue" is not a status. It is any action past its due date that is not verified or risk accepted, so the tracker should show it, not let someone type it.
Control points that keep the tracker honest
| When | Check | Evidence to keep |
|---|---|---|
| At the exit meeting | Each finding has a draft recommendation and a named management contact | Exit meeting minutes |
| When management responds | Each recommendation has an agreed action, owner and due date, or a written acceptance of the risk | Management's responses, filed with the final report |
| On a cycle set by risk | High-severity actions are followed up first, and more often | The dated follow-up log |
| When an owner reports "implemented" | Evidence is obtained and someone else confirms it | The evidence, and the verifier's name and date |
| When a due date moves | The new date and who approved the change are recorded | The revised date, and its approval |
| Before each audit committee meeting | Open and overdue actions are listed by owner and age | The report to the committee |
| At the next engagement in the same area | Prior recommendations are checked first | The prior-recommendations item on the request list |
Follow-up duties in African public sectors
Several jurisdictions write follow-up into law or official instructions. A tracker that cannot show these dates will be rebuilt by hand before each review.
| Country | What is set | Source |
|---|---|---|
| Kenya | The Accounting Officer's response and action plan go to the audit committee chair within fourteen days; quarterly internal audit reports are due within 14 days of quarter end. Since 25 September 2026, an accounting officer who fails to implement the recommendations of a National Assembly committee report on the Auditor-General's findings is liable to the PFM Act's s.199 penalty | PFM (National Government) Regulations 2015, regs 172(1) and 173(2); PFM Act s.68(4A), county s.149(3A) |
| Ghana | The Minister for Finance's 2023 Follow-Up Instructions make an audit follow-up tracking template "the main tool", recording each audit issue and how it was resolved. Management answers draft internal audit reports within ten working days, draft external audit findings within five working days and the draft Management Letter within thirty working days. The audit committee must make sure the head of the entity acts on recommendations | Audit Recommendations Implementation and Follow-Up Instructions (30 June 2023), ss.4(1) and 6.2(2); PFM Act 2016 s.88 |
| Uganda | Every vote's internal auditor reports quarterly to the Accounting Officer and the audit committee | PFM Act 2015 ss.47 to 49 |
| Rwanda | Boards and councils follow up recommendations through the audit committee, and the Chief Budget Manager must implement the recommendations of the Office of the Auditor General | Organic Law N° 002/2022.OL, Arts. 80, 81, 88 and 89 |
| Zambia | Internal auditors report quarterly to the Controller of Internal Audit, the Controlling Officer and the audit committee, which meets at least quarterly and reviews audit reports | PFM Act 2018 ss.14 to 17 and 19 |
| Nigeria | In every company, the head of internal audit reports to the audit committee at least once a quarter | FRC Audit Regulations 2020, reg. 30 |
Banks carry similar expectations through their regulators' governance rules; in Kenya, for example, the Board Audit Committee meets at least quarterly (CBK/PG/02). Check your own sector's rules.
Where spreadsheets break down
- The tracker is rebuilt, not kept. Findings are copied from the year's reports a week before the committee meets, and some are missed.
- Updates live in email. The owner's reply, and the evidence attached to it, never reach the tracker.
- "Implemented" means "the owner said so". No column records who checked, or when.
- Due dates drift. A revised date overwrites the original, so nobody can see how long an action has been late.
- History disappears. Each version of the spreadsheet replaces the last, and the trail of follow-ups is lost.
Where Creodata fits
AuditEDMS, our audit management software, keeps findings and their follow-up as part of each engagement's record. Each finding is recorded against the engagement with its severity, the recommendation and management's response, then the agreed action with its owner and due date. The action moves through agreed, in progress, implemented and verified, and the person who records an action as implemented cannot also verify it. If management accepts the risk instead, the acceptance needs a note. Every follow-up is logged with its date. A follow-up register shows open actions across engagements, with a filter for the overdue ones, and reports export to CSV for the audit committee pack.
The engagement itself runs as stages with evidence gates, on an internal audit template that is ready to use and adjusted to your methodology at implementation: notification, planning memorandum, entrance meeting, request for audit information, fieldwork, exit meeting, draft report, management responses, final report and archiving. Its starting request list includes the status of prior audit recommendations. Evidence is filed to your own SharePoint, versioned and checksummed, and every action is written to an audit trail. It runs in your own Azure subscription; Creodata operates it through standing management access recorded in your Azure activity log.
What it does not do: action owners are recorded by name, and nothing is emailed to them automatically, so your team follows up from the register. It has no audit universe or risk-based annual plan, and it is not working-paper software. On Microsoft Marketplace, Basic is US$200 a month for firms of up to 30 staff and Enterprise US$500 a month for firms of up to 75 staff, with priority support; pilots are by invitation.
Frequently asked questions
What is the difference between a findings tracker and an audit report?
The report is a point in time: what was found and what was recommended. The tracker carries each recommendation forward until it is verified or the risk is accepted, so it is the record the audit committee reads between reports.
Who should mark an action as verified?
Someone other than the person who recorded it implemented, usually a second auditor or the audit manager, and only after seeing the evidence. Standard 15.2 asks internal audit to confirm implementation, not to accept the owner's word for it.
How often should we follow up?
On a risk basis, as Standard 15.2 expects: high-severity actions sooner and more often. Many functions follow up every open action before each quarterly audit committee meeting, which in several public sectors is the reporting cycle the law sets.
Can we keep using our Excel tracker?
Yes. A disciplined spreadsheet with the columns above works for a small function. Software helps once several engagements run at once, when owners send evidence by email, or when you need to show an assessor the history of each follow-up rather than the latest version of a file.
See how AuditEDMS internal audit management software keeps findings, agreed actions and their follow-up on one record: request a pilot.