What would convince you the fix worked?

Hi {{name|there}},

Agreement on a finding is a start. The harder work is deciding who will act, resolving the obstacles and showing that the response has made a difference.

In Issue 50, we looked at where an assurance handoff can fail. In Issue 51, we agreed the evidence before the work starts. This time, we turn to the decision at the other end: what would convince you the fix worked?

This week, I’m sharing what I heard from risk and controls practitioners at Impero, followed by Evan Tsai’s guest article on why findings stall. Then we put it to work with a short closure review and the full Evidence Before Closure field guide.

FROM THE ROOM

Speaking about control theatre at Impero’s Compliance.Curated event in Copenhagen gave me the chance to compare perspectives with people doing this work every day. Three things stayed with me.

Control rationalisation is high on the agenda. People are ready to challenge the status quo. Risk and controls maturity is a journey: once the basics are in place, it is time to get brave and ask whether each control still deserves its place. For me, that means being clear about what it protects, what would change without it and whether there is a better way to manage the risk.

AI is moving faster than agreement on what comes next. The conversations covered tooling, control performance, testing and the role of the second line. There is plenty still to work through, while companies seem to be advancing quickly with agents. My practical question is who can approve, challenge or stop an agent’s actions, and how we will know its controls are working as intended.

Peer learning leaves you with things to do. Hearing different experiences and perspectives gave me a list of ideas I want to put into action. Watch this space.

Those conversations brought me back to a practical question: when we agree something needs to change, who has the responsibility and authority to make it happen? Evan’s two examples show why the answer matters.

GUEST PERSPECTIVE

By Evan Tsai • Phoenix Ascent Advisory LLC

I want to start with something most internal auditors have experienced but rarely talk about directly.

You do the work. The finding is solid. Management sits across the table, looks at the evidence, and agrees — yes, this is a real issue, yes, it needs to be fixed. The report goes out. The finding gets logged.

And then six months later, nothing has changed.

Not because anyone was dishonest. Not because the audit was flawed. But because somewhere between "we agree this is a problem" and "someone actually fixes it," the whole thing just... stalled.

I've seen this enough times now to know it's rarely about the quality of the audit work. It's almost always about what's underneath the finding — the governance structure that's supposed to carry it from identification to resolution. Decision rights. Ownership. Escalation routes. When those things aren't clear, even the most valid finding can drift indefinitely.

Let me show you what I mean with two examples. Same issue type. Completely different outcomes.

A mid-sized technology and manufacturing company had SAP as its core ERP, with a GRC tool extracting access profiles to flag Segregation of Duties conflicts. The SOD issue was first identified in 2023. Nobody disputed it — the access conflicts were real and everyone agreed something needed to be done.

But the finding was written in a way that left ownership open. The issue touched Finance, Accounting, and IT, and the write-up didn't pin accountability to any one of them. Each function read the finding and saw a problem that belonged to someone else.

So it sat. For six months, the finding lived in a tracker while conversations went in circles. Finance thought IT should lead since it was a system access issue. IT felt the business needed to define what an acceptable conflict even looked like. Accounting wasn't sure it was their call at all.

Eventually the organisation found a way out — compensating controls applied across all affected access. The finding got closed. The underlying SOD conflicts stayed.

The audit did everything right. The governance structure had no mechanism to force the ownership question to an answer, no escalation path to surface the stalemate to someone who could break it. So the path of least resistance won.

A larger services organisation had a comparable problem: elevated access and SOD conflicts in Oracle Fusion. I mention the size only to make a point — bigger doesn't automatically mean better governed. Plenty of large organisations have the same ownership vacuum as the first example. What made the difference here had nothing to do with headcount or budget.

This organisation had a compliance function that had positioned itself as a formal bridge between Internal Audit and the business. Not a passive go-between — an active one. When the SOD issue came up, that function didn't wait to be asked. They pulled the access data, analyzed where the real conflicts sat, and led a redesign of access roles where it actually made sense to do so.

Audit didn't have to chase anyone for a remediation plan. The structure had already answered the ownership question before it became a problem.

The result was real remediation. Not a workaround. Not a blanket compensating control. A deliberate, well-reasoned fix.

It's tempting to look at the second example and say the organisation succeeded because it was bigger, or better resourced, or had more mature processes. I'd push back on that. A small organisation with a well-positioned compliance function gets the same result. A large one without it hits the same wall as the first example.

The difference was structural. In the first case, the governance architecture beneath the finding had no way to carry the weight of resolution — no clear decision rights, no named owner, no escalation path that anyone was obligated to use. In the second, a functioning compliance layer had effectively pre-answered all of those questions.

Same issue type. Same audit objective. The structure underneath determined everything.

When a finding stalls, the instinct is usually to look at the audit — was the finding worded clearly enough, was the evidence strong enough, was management engaged early enough? Those are reasonable questions. But they're often the wrong ones.

Before the report goes out, the more useful diagnostic is structural. Ask:

In the first example, none of those had a clear answer going in. In the second, the compliance function had quietly answered all of them before the issue even surfaced.

Internal Audit can surface the truth. It can document the issue, make the case, and get management to agree. But whether that truth turns into action — whether the finding actually lands — depends on a governance structure that most audit functions spend very little time examining.

Transformation measured by movement has to start one level deeper than the audit itself. At the structure that decides whether movement is even possible.

That's where the real work sits.

Evan Tsai is the Founder of Phoenix Ascent Advisory LLC, a governance, risk and compliance consulting firm that helps senior audit and compliance leaders build governance structures that hold up under pressure. Both client examples have been anonymised. Connect with Evan on LinkedIn.

PUT IT TO WORK

Evan’s examples take us from agreeing a finding to getting a response in place. The next question is what that response allows us to conclude about the risk.

A compensating control can be a sound response when its coverage and effectiveness are evidenced. A redesigned role needs evidence too. The type of fix alone cannot settle the closure decision.

Choose one action due for closure and review it with the person who owns the underlying risk.

Match the depth of the review to the risk. Where implementation is complete but effectiveness remains unproven, keep that distinction visible. Management remains responsible for the risk and any decision to accept it.

BTL TOOLBOX

FG02 · The complete nine-page Action Closure Field Guide

Use the guide alongside the exercise to make a more defensible closure, validation or escalation decision. It brings together the five questions before closure, evidence guidance, worked examples and a closure review record.

Bring one action and its evidence pack to your next review. Use the guide to identify the claim the evidence supports, then record the decision and any follow-up.

The appetite for practical AI discussion and peer learning is also why Trent’s upcoming conference feels relevant to this edition.

YOUR VIEW

Whether it has been implemented, whether it operates consistently, or whether it has made the intended difference? Reply and tell me where your team gets stuck.

Tim Buckley
Founder, Beyond the Lines™ | Integral Assurance

Assurance Impact | Assurance to Action