Why compliance findings do not get closed out

The audit lands. It carries three hundred findings, graded, tabulated, and delivered in a report with a professional cover. Six months later the report has been read by four people and the schedule is still a schedule.

Nobody involved is lazy. The reasons are structural. They repeat across organisations that have nothing else in common, and each one has a different remedy, which is why they are worth setting out separately.

The findings are a list, not a plan

Three hundred items with no sequence, no cost, no owner and no dependency map is not something an organisation can act on. It is something an organisation can feel bad about. Turning it into work means packaging it. Which items are one job and not eleven. What has to happen before what. What needs a shutdown, what needs capital, what can be absorbed into planned maintenance.

That translation is a piece of work in itself, and it is nobody’s job. The auditor’s scope ended at the report. The internal team’s capacity was already committed.

The person who owns the finding cannot close it

Findings are routinely allocated to whoever is nearest, often the person who showed the auditor round. A finding that needs fifteen thousand pounds of capital, or a contractor procured, or a process changed in another department, cannot be closed by an engineer who has none of those levers. So it stays open, and it looks like inaction when it is really a resourcing decision nobody has taken.

Grading by ease, not by consequence

Where findings are graded by how easily they can be fixed, the register empties from the bottom. Twelve months later the closure rate looks respectable and every item that could hurt somebody is still open. Grade by consequence, which means asking what happens if this is not done, and the register empties from the top. That is slower, and it looks worse on a slide.

Closure means the paperwork, not the problem

This is the most common failure and the hardest to see. A finding is marked closed because an action was recorded, not because evidence exists that the thing is now true. The test is simple and unforgiving. If the same auditor returned tomorrow and asked for proof, could you produce it without reconstructing anything? If not, the finding is open, whatever the register says.

The tell is a finding raised twice in successive audits. That is not two findings. It is one finding and a failed closure.

Nowhere the position is looked at

Remedial programmes need a standing meeting with the same three columns every time. What closed since we last met. What is at risk. What needs a decision from the people in this room. Without it the work falls to whoever feels most anxious about it, and anxiety is not a governance mechanism.

Why it matters more than it looks

An assessment that is not closed out is worse than no assessment at all. The report is written evidence that the organisation knew. If something goes wrong afterwards, the question is not whether you had identified the risk. You plainly had, in a numbered schedule, on a date. The question is what you did between identifying it and the event.

An open finding is not a neutral administrative state. It is a record of knowledge without action, and an insurer, a regulator, a customer or a court will read it that way.

The organisations that get this right are rarely the ones with the best audits. They are the ones that treat the schedule as the start of the work and not the end of it.