Expert verified
You open the draft audit report of the recently concluded statutory audit and scroll to the observations section. Three of the findings are exactly the same as last year. The same a segregation of duties gap at a branch, a reconciliation that happens “around month-end, usually” instead of on the schedule it’s supposed to, the same vendor payment documentation issues that were flagged eighteen months ago.
Your operations team said the fixes were implemented, the tracker shows the findings as “closed.” Yet they appear again.
This is one of the more common patterns at ₹100 crore-plus enterprises running multiple plants or branches. The issue mostly arises when a finding gets closed at the location where it was raised, without anyone checking whether the same gap exists at the other locations running the same process, or without the fix actually being re-tested before the next audit cycle.
This post is meant for a CFOs or Compliance Head at ₹100 cr+ multi-state enterprises who is tired of watching the same category of issue survive one remediation attempt after another. Learn why findings recur, how PKC breaks the cycle through structured remediation, what an audit-ready compliance tracker looks like, and how progress is reported to the board.
Why Audit Findings Keep Repeating Year After Year Across Multiple Branches
Recurring audit findings follow predictable patterns. Understanding why they recur is the first step to making them stop.
Root cause is not addressed
The most common reason a finding recurs is that the organisation fixed the specific instance but did not address what caused it. An invoice approval delay at one branch gets expedited for that invoice.
But the underlying issue, a manual approval process with no escalation mechanism, remains. The same delay occurs again with the next invoice.
Inconsistent implementation across locations
One branch implements the fix correctly. Another branch interprets it differently. A third branch does not implement it at all because the plant manager was on leave when the instruction came through.
Without a standardized, group-wide approach, fixes become location-specific and inconsistent. For multi-plant or state enterprises this is a persistent challenge. Multi-location compliance breaks down because traditional approaches to compliance management were never designed for the scale and complexity of modern multi-location operations.
Ownership is unclear
Assigning a finding to “the operations team” or “the finance team” does not create accountability. Each significant action should have a named owner, a target date and evidence required to demonstrate closure.
The finding is addressed temporarily, then drifts back to its original state when the person who implemented the workaround moves on or gets busy with other priorities.
Manual workarounds replace documented controls
Employees often introduce shortcuts to keep operations moving. Over time, those shortcuts become the way work is actually performed, even though the SOP says something different.
The auditor identifies the gap, management promises remediation, but the underlying workaround continues.
Remediation lacks real-time visibility
Many enterprises still manage audit findings through spreadsheets and email chains.
Status updates become inconsistent, overdue actions are difficult to identify, and senior management may receive a summary only when the next audit is approaching. By then, several findings may have remained open for months.
Information processing across reporting layers
Information can lose accuracy as it moves through multiple reporting layers. A location manager may report a finding as closed, the regional head may present the region as on track, and the audit committee may ultimately hear that the issue has been addressed.
No one is necessarily misrepresenting the position, the detail is simply being diluted at each stage because there is no structured verification at the source.
Audit fatigue
When the same findings appear year after year, teams stop taking them seriously. The findings become background noise and urgency dissipates.
The organisation becomes desensitized to audit observations that should trigger immediate action.
For multi-location businesses, remediation should be managed centrally and not as isolated fixes. Maintain one findings register with owners, deadlines, risk ratings and closure evidence, and use each finding to check the same process across other locations.
A CFO should not ask “Has this finding been fixed?”, instead ask “Has the root cause been removed, has the fix been applied wherever the same process operates, and can we prove it is still working?”
PKC’s Approach: From Finding to Root Cause to Fix, Standardized Group-Wide
Every PKC remediation engagement starts with two questions: “why did this finding happen here,” and “does the same condition exist elsewhere in the group?” not just, “how do we close this finding?”
Here’s the approach we follow:
1. Root cause identification
We start by distinguishing the immediate trigger from the underlying cause. A recurring delay in procurement approvals, for example, may result from an unclear delegation of authority, insufficient segregation of duties or an ERP workflow that does not support the required approvals.
Findings may be classified as design gaps or operating gaps. A design gap requires the control itself to be redesigned. An operating gap may require clearer ownership, better scheduling, system enforcement or stronger evidence of performance. This helps prevent management from applying the wrong fix.
2. Standardized group-wide fix
A finding at one branch prompts a review of the same process across other relevant plants, warehouses and entities. If the same approval workflow or SOP is used across four locations, fixing it at only one location will not address the underlying risk.
Not every location needs to operate identically, genuine operational differences should remain. A plant’s job-work reconciliation and a retail outlet’s cash reconciliation require different controls. What needs to be consistent is the risk assessment, documentation structure, control terminology and remediation methodology.
3. Documented action plan
Each significant finding is translated into a specific Audit Action Plan covering:
- The finding and underlying root cause
- Required corrective action
- Responsible owner
- Target completion date
- Evidence required for closure
- Method that will be used to verify the fix
This creates accountability and gives management a way to track remediation across locations rather than relying on informal email updates.
4. Implementation support
For organisations without sufficient internal bandwidth, implementation is harder than identifying the issue. At PKC, we work with client teams to define practical corrective actions and establish a mechanism for monitoring progress.
The internal finance and operations teams remain responsible for implementing changes. We offer an external review to challenge assumptions, compare locations and monitor whether agreed actions are actually progressing.
5. Verification before closure
A finding is not closed just because someone says it has been fixed. PKC verifies that the control is operating effectively, that the fix has been sustained over a reasonable period, and that the same issue does not resurface.
This may involve re-testing transactions, reviewing supporting documentation, checking control evidence and confirming that the corrective action has been implemented across all locations carrying the same risk.
For a CFO, this creates a more meaningful definition of closure: the root cause has been addressed, the appropriate fix has been applied wherever the risk exists, and there is evidence that the control continues to work. This turns audit remediation from an annual exercise into an ongoing audit and compliance discipline.
Building a Compliance Tracker Audit Committees at ₹100 Cr+ Enterprises Can Actually Use
A compliance tracker should help management and the Audit Committee answer three questions quickly: What is still open? Who owns it? When will it be closed?
A tracker, a spreadsheet with 200 rows and colour-coded statuses is not useful. A useful tracker must remain simple enough for finance and compliance teams to maintain throughout the year, while capturing enough information to distinguish a genuinely closed finding from one that has only been marked complete.
What the tracker should capture
Each finding should be linked to the specific process and location where it originated, along with its root cause and remediation status.
| Tracker field | Purpose |
| Finding, process and location | Identifies exactly where the issue occurred |
| Root cause | Distinguishes a design gap from an operating failure |
| Named owner | Assigns accountability to one individual |
| Target closure date | Establishes a measurable deadline |
| Status and supporting evidence | Shows what has actually been completed |
| Re-test date | Establishes when the corrective action will be verified |
“Closed” should not mean that the responsible manager has confirmed completion. It should be supported by evidence that the corrective action was implemented and, where appropriate, that the revised control operated effectively.
PKC builds compliance trackers that meet these requirements:
Real-time status dashboard
The tracker provides a real-time view of all open findings, their status, and their age. Audit committees and senior management receive a Follow-Up Report or Status Tracker that uses a RAG (Red-Amber-Green) status to indicate progress.
- Red means the finding is open and behind schedule
- Amber means it is in progress but needs attention
- Green means it is closed and verified.
Location-level visibility
For multi-location enterprises, the tracker shows status by location. This allows the Audit Committee to see which branches are consistently behind on remediation and which are performing well.
The tracker also enables read-across: if a finding is identified at one location, the tracker flags whether the same issue exists at other locations.
Ownership assignment
Every finding in the tracker has a named owner. Not a team. Not a department. A specific individual who is accountable for ensuring the fix is implemented and sustained.
Age tracking
The tracker shows how long each finding has been open. Findings that exceed predefined thresholds trigger automated alerts. This prevents issues from languishing for months without attention.
Audit trail
The tracker maintains a complete history of each finding: when it was identified, what actions have been taken, what verification has been performed, and when it was closed.
This provides the documentation that audit committees and regulators require.
Integration with the audit cycle
The tracker is not a standalone document. It is integrated into the ongoing audit cycle.
New findings from the current audit are added, closed findings are verified and removed. The tracker becomes the single source of truth for remediation status.
For an Audit Committee, the value of the tracker is that the system provides a current, location-wise and evidence-based view of unresolved compliance and audit issues, and makes it difficult for recurring findings to disappear into annual reporting cycles.
Case Snapshot: Closing Out a Backlog of Recurring Findings Across Multiple Branches
Recurring audit findings become particularly difficult to manage when the same processes operate across dozens of stores or plants. A problem identified at one outlet may appear unrelated to an issue at another, even when both are symptoms of the same underlying control weakness.
Let’s take a composite example of how PKC helps based on the kind of engagement we repeatedly undertake with multi-location manufacturing, retail and trading groups.
The Challenge
A ₹150 crore retail chain operating across 12 cities had accumulated a backlog of recurring audit findings from previous audit cycles. The issues included inventory reconciliation gaps, cash handling discrepancies and delays in vendor payments.
Some findings had remained open for extended periods, while similar observations continued to appear at different stores.
The internal audit team was tracking findings manually, with limited consistency in ownership and follow-up. Individual stores were addressing issues locally, but there was no consolidated view of whether the same weakness existed across the wider retail network.
Several issues had been addressed at individual stores without identifying the common process or control weakness that was causing them to recur.
PKC’s Approach
PKC began by consolidating historical findings into a central remediation tracker. Each finding was mapped to its process, control, store, root cause, owner, target date and verification requirement.
The root cause analysis showed that apparently separate findings often had common causes.
- Inventory reconciliation issues were linked to inconsistent store-level procedures and review practices
- Cash handling exceptions were associated with unclear responsibilities and inconsistent supervisory checks
- Vendor payment delays were linked to unclear approval responsibilities and insufficient escalation mechanisms
PKC then developed standardised remediation actions for each root cause category. Store-level owners were assigned responsibility for implementation, while regional managers monitored consistency across their locations.
The compliance tracker provided a consolidated view of open findings, ageing, ownership, target dates and remediation status. Importantly, a finding was not treated as fully closed simply because management reported that the action had been completed. Supporting evidence and follow-up verification were used to establish whether the revised process had actually been implemented and sustained.
The Outcome
The retail chain moved from managing audit findings as isolated store-level issues to managing them as group-wide process and control risks.
Management and the Audit Committee gained a single view of recurring findings across all 12 cities, making it easier to identify overdue actions, compare locations and determine whether a finding required a broader corrective action.
The engagement also showed why recurring audit findings should be assessed by root cause rather than only by the location where the auditor first identified them. A control weakness that appears at 3 stores may represent one underlying process problem rather than three unrelated failures.
The specific number of findings resolved and the time required will vary by organisation. The more important outcome is a remediation process in which each finding has a clear owner, corrective action, supporting evidence and verification before closure.
Assigning Ownership Across Reporting Lines so Fixes Survive Beyond the Audit Cycle
Merely naming the department and assigning them fixes does not create clear accountability.
In a multi-location enterprise, fixing one finding may involve a plant accountant, regional finance head, corporate controller and IT team, but one person still needs to be accountable for seeing the action through to closure.
Here’s how its done:
Named ownership, not team ownership
The most important rule of audit remediation is that every finding must have a named owner: a specific individual with a name and a job title. That individual is accountable for ensuring the fix is implemented, verified, and sustained.
For example, a segregation-of-duties issue at a plant may require changes by the local finance team, regional head and corporate controller. One designated owner should coordinate all three actions.
Separate location responsibility from group oversight
Multi-location remediation works best when accountability exists at both levels. The location owner drives implementation at the relevant plant or branch, while the corporate owner ensures the corrective action is applied consistently wherever the underlying risk exists.
This prevents a common failure where the head office assumes that a policy communication means remediation is complete, while local teams continue using the old process.
Build escalation into the tracker
Ownership is effective only when missed deadlines trigger escalation. Overdue findings should automatically move to the next management level rather than simply receive a revised completion date.
For example, a plant-level delay may escalate to the regional finance head, while a significant unresolved issue may require CFO or Audit Committee visibility. Escalation thresholds should be defined upfront based on risk and reporting structure.
Keep ownership updated
A finding can quietly become ownerless when an employee changes roles, leaves the organisation or moves to another location.
The tracker should therefore record the current accountable person and require ownership to be reviewed during each reporting cycle.
Integration with performance management
For remediation to be taken seriously, it must be integrated into performance management. Owners should have remediation targets as part of their performance objectives.
Progress should be reviewed in regular performance meetings. This signals that audit remediation is a core business priority.
How to test:
Ask: Can you identify one person who will answer for every significant open finding, even when the fix depends on several teams and reporting lines? If not, the organisation is tracking findings, but it is not yet managing accountability.
Reporting Progress to the Audit Committee and Board of a Multi-Layered Organization
An Audit Committee or Board does not need a line-by-line account of every audit finding. What it needs is: what’s genuinely at risk right now, what’s on track, and what’s stalled and needs the committee’s own intervention to unblock.
At PKC we structure an audit committee reporting around these questions.
Concise management view
The first page immediately shows the number of open findings, findings closed during the reporting period, and their distribution by risk or status. A RAG classification makes this easier to interpret:
- Red: Materially overdue or requiring escalation
- Amber: In progress but requiring monitoring
- Green: Remediated and verified
This allows the committee to understand the overall position before moving into individual findings.
Location-level breakdown
For a group operating across several plants, branches or entities, consolidated reporting can hide location-level weaknesses.
PKC’s reporting approach therefore includes a location-wise view, allowing management and the Audit Committee to identify whether a particular plant or branch has a higher concentration of open or overdue findings.
This also supports read-across. If a control weakness is identified at one location, management can determine whether the same process operates elsewhere and whether the exposure has been addressed consistently.
Age analysis
A finding open for 20 days should not receive the same attention as one that has remained unresolved for three reporting cycles. The tracker presents findings by age and risk severity, making long-standing issues visible.
The emphasis remains on actual exposure. A finding with potential financial, fraud or compliance consequences gets immediate attention even if it is relatively new, while a lower-risk documentation issue may reasonably remain on a longer remediation schedule.
Root cause analysis
The report identifies patterns in recurring findings. If multiple findings share a common root cause, the report highlights this. This allows the committee to focus on systemic issues rather than individual instances.
Regular reporting cadence
Waiting until the annual statutory audit to report remediation creates avoidable pressure. A quarterly or otherwise risk-appropriate reporting cycle gives management and the Audit Committee a current view of open findings, overdue actions, recurring root causes and verified closures.
Quarterly deep dive
In addition to regular status reporting, PKC provides a quarterly deep dive that reviews remediation progress, identifies emerging trends, and recommends adjustments to the remediation approach. This ensures that the Audit Committee has the information it needs to exercise effective oversight.
The status of all open and closed findings is regularly reported to the Audit Committee and senior management. This regular reporting, combined with the structured escalation process, ensures that remediation stays on track and that the Audit Committee has visibility into what is working and what is not.
What you need to check as a CFO or Audit Committee Chair: Can the report show what is genuinely at risk, what is progressing, what is stalled, and what requires a decision from the committee? If it can, audit reporting becomes a governance tool and not just a compliance document.
If your last two audit cycles have surfaced findings that look familiar, or your audit committee is asking questions about remediation status your team currently can’t answer with evidence, Schedule an Appointment with PKC to discuss what a tracked remediation system built around your specific locations would look like.
FAQs
Q1: Why do the same audit findings keep recurring across audit cycles at multiple branches?
Recurring findings usually indicate a root cause gap. Common root causes include inconsistent implementation of controls across locations, unclear ownership for remediation, manual workarounds that bypass controls, and a lack of real-time visibility into remediation status. Without addressing the underlying cause, the same issue will reappear in the next audit cycle.
Q2: What is a compliance tracker and why does an audit committee overseeing several entities need one?
A compliance tracker is a structured tool that tracks all open audit findings, their status, ownership, and target closure dates. It generally uses RAG (Red-Amber-Green) status to indicate progress. For audit committees overseeing multiple entities, a compliance tracker provides consolidated visibility into remediation status across all locations, enables identification of consistent problems, and supports effective oversight.
Q3: How does PKC help assign ownership for audit remediation across plants and branches?
PKC assigns every finding to a named individual who is accountable for implementation and verification. For multi-location enterprises, ownership is assigned at both the location level and the corporate level, with escalation protocols for issues that are not resolved. This ensures that fixes are sustained beyond the audit cycle.
Q4: How often should audit committees at ₹100 Cr+ enterprises review open findings?
Audit committees should review open findings at every scheduled meeting, which is usually quarterly for most enterprises. In addition, the committee chair should receive escalation reports for findings that are behind schedule or have been open for more than 90 days. Regular reporting ensures that issues do not languish unnoticed.
Q5: What is the difference between a compliance fix and a process improvement?
A compliance fix addresses a specific instance of non-compliance. It resolves the immediate issue but does not necessarily prevent recurrence. A process improvement addresses the underlying cause of the issue and redesigns the process to prevent the issue from occurring again. Process improvements are more durable and reduce the risk of recurrence. PKC’s approach focuses on process improvements, not just compliance fixes.
Q6: How does PKC report remediation progress to the board of a multi-layered organization?
PKC provides structured reporting that includes a RAG status summary, location-level breakdown, age analysis, root cause trends, and escalation protocol for findings that are behind schedule. This gives the board and audit committee a clear, concise view of remediation progress without overwhelming them with operational detail.
