Hi,
Every audit finding arrives with the same private thought attached: we will fix that before next year. Then next year arrives, the same finding appears, and something changes that most entities do not see coming.
A first-year finding is treated as an event. A repeat finding is treated as evidence about how your entity is run, and the consequences stack:
- It is identified as a repeat in the report and in the federal data, where anyone can see it
- Your auditor’s risk assessment rises, which means more testing, larger samples and a higher fee, for the same work you were doing before
- You can lose low-risk auditee status, which broadly requires clean prior years and timely filing. Losing it means a larger share of your federal programs get audited as major programs, so the audit expands in exactly the year you least want it to
- Grantors and pass-through agencies read findings and can attach conditions to future awards
- Rating agencies and bond counsel read a repeated material weakness as a governance signal rather than a bookkeeping one
The uncomfortable part is why findings repeat, because it is rarely carelessness. It is that the corrective action plan was written to satisfy the auditor rather than to change anything.
A plan that says “management will implement additional review procedures” has no chance. It names no person, no process, no date and no way of knowing whether it worked. It is a sentence, and sentences do not reconcile bank statements.
A corrective action plan that actually works contains five things:
- The root cause, stated honestly. Not “an oversight” but “one person performs the reconciliation and no one reviews it”
- The specific change, described so someone outside could follow it
- A named person, not a title and not “management”
- A date, and a first checkpoint well before the next audit
- How you will know it worked, which is usually a document that will exist by then
And there is a category that no amount of diligence will close, which is worth naming out loud. Some findings are structural. A segregation of duties finding in a three-person office is not a discipline problem. It is arithmetic, and it will repeat every year until the structure changes: a reviewer from another department, a board member opening the bank statement, or the reconciliation moved outside the entity entirely. Trying harder is not a corrective action plan for a structural finding, and auditors know the difference.
The practical move, if you have a finding you have now seen twice:
- Separate your findings into fixable by process and structural, and stop treating them the same way
- Rewrite the corrective action plan for each with a name and a date in it
- Put the first checkpoint months before fieldwork, not the week it starts
- For structural ones, decide what outside capacity is cheaper than the finding, the extra testing and the expanded audit
That is most of what we do for public entities, and it is why this sequence has covered the ground it has:
- Audit, Single Audit and Yellow Book engagements, and audit finding remediation
- Internal control design that fits a small office, including reconciliation review from outside the entity
- Fund accounting bookkeeping, payroll, grant and subrecipient compliance, and capital asset records
- ACFR and AFR preparation, GASB implementation, and board or council ready reporting
Reply to this email by Friday and we will set up a free 15-minute call with one of our senior government specialists. Send us the findings and corrective action plan from your last audit, and we will tell you on the call which of them are likely to repeat this year, and which ones will keep repeating until something structural changes.
Sincerely,
—
George Dimov, CPA
Licensed and Insured
(833) 829-1120 toll free
(212) 994-8081 Fax
www.dimovtax.com