Follow-up
Response and Follow-up is a huge part of the methodology for internal auditing, as the corrective action plan should address specific items that must be done as well as formulate a plan to ensure the processes will be modified to prevent future violations. Do you have any suggestions for positive/negative reinforcements to ensure adherence to the corrective action plan?
DeMario - What a great question! Some schools balk at having to "positively" reinforce compliant behavior/operations but, I am a huge fan of that approach. I have seen organizations with the "right", compliant culture driving it by having an "A-List" type of acknowledgement whereby campuses are awarded the status of "A-List" (or Gold Standard or any other positive name) for achieving certain criteria (limited number of audit findings, prompt response to correct, etc.). Campuses took great pride in achieving this status, making it a true motivator. Maybe others on this forum have additional suggestions. As for the negative, I think there needs to be a "zero tolerance", "no exceptions" type of approach to resolultion of findings. This is tougher to reinforce from the audit office side as the management overseeing the campus(es) has to hold individuals accountable with appropriate consequences as needed. The audit office itself I think is limited to the positive reinforcement options and escalating communications of failure to adhere to management as needed.
This is a very interesting concept! Awarding a campus a gold star, or silver, or whatever level you decide. Great idea, thanks!
One would want to address within the methodoly, the process of incorporation of appropriate monitoring once the corrective action is implemented, in addition to the action plan of modifying the process itself. This would be a positive reinforcement for adherence.
Excellent point, Maureen. A "fix" without proper ongoing monitoring does not eliminate risk. Your suggestion ensures that the risk is mitigated with a plan for keeping the eye on the issue and relevant process changes intended to address the matter.
The type of final audit report I like to use is the one that details the issues/findings, presents a recommendation for each for management consideration and a third column with Management's action plans along with the responsible person and the completion date. Integrating all the elements in this third column, establishes management's commitment with a feasible action plan which should be in place by the date they indicated. Although, it put more pressure on our side to obtain final information prior to be able to release the final report it is worthy for the benefit of our institution. As a result, it serves as a guide for our recurring follow-up procedures. In addition, statistics of the number of issues/findings vs the % of action plan completed, also is very valuable for top management (i.e. shows progress) while encourages the responsible parties to comply with action plans self established (i.e. makes it more difficult to explain why their own plan or estimated due dates were not achieved).
Yamira,
Your approach sounds like an effective way to manage the steps needed to rectify any finding. That certainly is the most important part of any such review - if issues are identified and not addressed, that will create further issues for the institution. Demonstrating progress toward resolution is a great way to monitor.
Traci Lee
