When a control deficiency is reported as fixed before it is

The most common failure is a control deficiency reported as remediated to management while the evidence still shows it failing. It starts when closure depends on the owner's word. It surfaces when auditors test a sample. It is fixed by tying closure to retested evidence and a shared register.

How it starts

Take a typical case. An internal review finds that invoices are being paid without a match between the order, the receiving report and the invoice. The payables lead changes a system setting so the match is enforced. The lead then emails the controls team to say the issue is resolved, and the tracker is marked closed.

Nobody retests. The setting applied to the main entity only. Manual payments raised outside the purchasing module still skip the match entirely. On the management dashboard, though, the item has turned green.

No one in this chain is careless. Owners are under pressure to clear findings, and the controls team rarely has capacity to verify every closure. The tracker records what people say happened. It does not record whether the control now works.

Why each audience ends up hearing something different

Reporting on controls compliance goes to several places, and each report tends to draw from its own source.

Internal management sees the tracker summary. External auditors receive the prepared-by-client packages, which contain raw evidence: payment listings, approval logs, sample documentation. Statements to regulators, lenders or a securities exchange are often drafted by legal or treasury from the management summary, because it is the tidiest document available. Third parties such as grant bodies or key customers may get a certification letter written from memory of the last audit.

So the board hears the payment control is fixed. A lender's compliance certificate says the same. Meanwhile the auditors hold a file that contradicts both. That gap is the real damage. A deficiency on its own is manageable. A public statement the evidence does not support is far harder to walk back.

How it gets spotted

Usually the auditors find it. They pull payments made after the stated remediation date and find exceptions. Or their walkthrough reveals a manual override path that the cycle memo never mentioned.

Inside the finance team there are earlier warnings for anyone who looks:

• A closed item whose evidence file holds nothing but an email from the owner.
• No retest date recorded against the closure.
• A cycle memo last edited before the fix went in.
• The same weakness reappearing under a new reference in a later review.
• Different wording about the same control in the management pack and the external certification.

The last of these is the cheapest to catch. Laying the outgoing reports side by side before sign-off exposes most of these cases.

How it is fixed

First, deal with what has already gone out. Reopen the deficiency. Agree its severity with the auditors, and identify any adjustments their findings require. Then decide with legal whether any statement already issued to regulators, lenders or other outside parties needs correcting or qualifying. That conversation is uncomfortable, but it gets harder the longer it waits.

Next, change how closure works. The person who fixes a control should not be the person who closes it. Closure should require a retest on a fresh sample, taken once the repaired control has operated long enough to produce meaningful evidence. The retest result, the sample and the updated cycle memo all belong in the evidence file before the status changes.

Then make every report come from one place. A single deficiency register should feed the management pack, the auditor packages and the external certifications. If legal drafts regulatory wording, it should draft from the register, never from a slide. Before any external report is signed, someone should reconcile its claims against the register line by line.

Finally, keep cycle memos current as part of remediation itself. A memo that describes the old process misleads auditors and new staff alike.

Questions to ask the people who run the process

Documented procedure and daily practice drift apart here more than almost anywhere in finance. Ask the people doing the work directly.

• When an owner says a control is fixed, what actually happens before the tracker changes?
• Who decides an item is closed, and can that person also be the one who made the fix?
• Where does the wording in the regulator or lender certification come from? Who writes it, and what do they read first?
• Are there payments, journals or approvals that can bypass the control being reported on? Who knows about them?
• When did someone last walk through the process against the cycle memo?
• If the auditors asked for retest evidence on the last remediated item, how long would it take to produce?
• Has any external report ever been corrected after issue? What triggered it?
• Which reports go out without anyone in the controls team seeing them first?

The answers to the third and last questions often reveal the most. They show which reports are drawn from evidence and which are drawn from someone's summary of it.

APQC's Process Classification Framework® (PCF) is an open standard developed by APQC, a nonprofit that promotes benchmarking and best practices worldwide. To download the full PCF or to view definitions and measures, please visit www.apqc.org/pcf.