OTTER AUDIT / INSIGHTS

When should an audit finding be considered resolved?

Posted by: Alex Jones
07 Nov 2026

An audit finding should be considered resolved when the remediation has been implemented, independently verified with objective evidence, and shown to operate effectively over a meaningful period. A manager's confirmation that action has been taken is not sufficient on its own. In delegated authority audits, closure means the original control weakness no longer exists in practice.

The right standard depends on the severity of the finding, the nature of the control, and how often the process runs. The sections below cover the evidence required, the role of management assurance, operating periods, partial closure, reopening, and documentation.

What evidence is needed to close an audit finding?

Closing an audit finding requires objective, verifiable evidence that the corrective action has been implemented and that the control now works as intended. The evidence must address the original root cause of the finding, not just show that a task was completed. Auditors should be able to reperform or test it independently.

Acceptable evidence depends on the type of finding. For a coverholder, typical examples include:

Updated documents: a revised underwriting guide, authority matrix or claims handling procedure, with version control and an approval date.
System changes: screenshots, configuration records or exception reports showing a referral rule or mandatory field now operates.
Sample testing: a fresh sample of files or transactions processed after the fix, showing the correct outcome.
Training records: attendance logs and competence assessments, ideally paired with evidence that behaviour has changed in practice.
Management information: bordereaux, referral logs or complaint registers demonstrating the control is being used.

The strongest evidence is outcome based. A new procedure shows intent. A sample of post-implementation files that follow the procedure shows effectiveness. Where a finding relates to a delegated underwriting authority breach, for example, evidence should demonstrate that subsequent risks were bound within authority or referred correctly.

Is management's confirmation enough to close a finding?

No. Management's confirmation is a necessary starting point but is not enough to close an audit finding. It records that the coverholder or agent believes the issue is fixed. Closure requires independent validation, because the person who owns the control is not best placed to assess its effectiveness.

Confirmation from management is still useful. It tells the auditor or the insurer's delegated authority team that remediation is ready for review, and it often comes with an updated action plan and supporting documents. The reviewer's task is then to validate that claim.

The level of validation should scale with risk. A low-rated administrative finding, such as an outdated contact in a procedure document, may reasonably be closed on documentary evidence. A high-rated finding, such as authority breaches, inadequate claims reserving or weaknesses in complaints handling, should be closed only after the reviewer has tested the control directly. This might involve a desktop review of new samples or a follow-up visit.

Insurers overseeing many delegated authorities often need a pragmatic approach. A risk-based follow-up model, where evidence requirements are set by finding severity, keeps oversight proportionate without leaving significant issues closed on trust alone.

How long should a fix operate before closure?

A fix should operate for long enough to demonstrate that it works consistently, which usually means at least one full cycle of the control. There is no universal period. A monthly bordereaux process needs several months of evidence, while a one-off documentation update can be closed once verified.

The key factors are:

Frequency of the control: a daily or weekly control generates enough evidence quickly. An annual control, such as a yearly review of binder compliance, may need to be tested at the next occurrence or closed as "implemented, pending effectiveness testing".
Severity of the finding: higher-risk findings justify a longer observation window and a larger sample.
Volume of activity: a coverholder with low transaction volumes may take longer to generate a meaningful sample than a high-volume scheme.
Nature of the fix: process and behaviour changes need time to embed, while one-time corrections do not.

A useful distinction is between implemented and operating effectively. A finding can be marked as implemented once the change is in place, but should only be closed once effectiveness is confirmed. Many audit follow-up processes record both stages separately, which gives a more honest picture of remediation progress.

Can a finding be partially resolved or accepted as a risk?

Yes. A finding can be partially resolved when some elements of the action plan are complete and others remain outstanding, and it can be formally risk accepted when the business decides not to remediate. Both outcomes should be recorded explicitly and never presented as full closure.

Partial resolution

Where a finding has several components, the status should reflect exactly what remains. For example, a coverholder may have updated its complaints procedure but not yet completed staff training. The finding stays open, with a clear note on the outstanding action, a revised target date and a named owner. Marking it closed because most of the work is done hides residual exposure from the insurer.

Risk acceptance

Sometimes remediation is impractical or disproportionate to the risk. In a delegated authority arrangement, the decision to accept a risk should sit with someone who has authority to do so on the insurer's side, not solely with the coverholder. The acceptance should be documented with the rationale, any compensating controls, the person approving it and a review date. A risk-accepted finding is not a resolved finding. It is a recorded decision to live with a known weakness, and it should be revisited periodically.

When should a closed audit finding be reopened?

A closed audit finding should be reopened when new evidence shows the original weakness has returned, the fix has stopped operating, or the closure was based on incomplete or inaccurate information. Reopening is a normal part of a healthy follow-up process, not a failure of it.

Common triggers include:

A later audit or file review finds the same issue recurring.
Bordereaux, claims data or complaint trends show the control is no longer being applied.
A change in systems, staff or the underlying regulation undermines the earlier remediation.
Evidence supplied at closure turns out to have been incomplete, outdated or misleading.

When a finding is reopened, the record should show why, who made the decision and what the revised action and deadline are. Repeat findings deserve particular attention, because they suggest the root cause was not properly addressed the first time. A recurring issue in a delegated underwriting or claims authority often points to a gap in oversight, training or resourcing rather than a one-off mistake.

How should closure be documented and reported?

Closure should be documented in a clear audit trail that records the original finding, the action taken, the evidence reviewed, who validated it, and the date and basis of closure. Reporting should give the insurer an accurate view of what is closed, what is open and what has been accepted.

A sound closure record typically includes:

The finding reference, description and original risk rating.
The agreed action plan, owner and target date.
A summary of evidence received and the testing performed to validate it.
The closure status: closed, closed pending effectiveness testing, partially closed, risk accepted or reopened.
The name of the reviewer and the date of closure.

At portfolio level, delegated authority and audit managers benefit from a consolidated view showing open findings by severity, overdue actions and repeat issues across coverholders. Clear, concise follow-up reporting is part of what makes audit work actionable. Otter Audit's reports are written so findings, reasoning and closure status are easy to understand, which supports the working relationship between insurers and their agents.

The principle behind all of this is simple. A finding is resolved when the evidence, not the assurance, shows the risk has been dealt with.

Frequently Asked Questions

How do I start building a finding closure process if we don't have one yet?

Start with a simple tracker that records each finding's reference, severity rating, owner, target date, evidence received and current status. Then define evidence requirements by severity, for example documentary evidence for low-rated findings and independent testing of fresh samples for high-rated ones. Assign a named reviewer who is independent of the control owner, and agree a regular cadence for reviewing open items.

What should I do if a coverholder keeps missing remediation deadlines?

First establish why the deadline is being missed, as the cause is often resourcing, unclear ownership or an unrealistic action plan. Agree a revised date in writing, record the reason for the extension and escalate persistent delays to senior management on both sides. For high-severity findings, consider interim measures such as tighter referral thresholds, additional file reviews or temporary restrictions on authority until the fix is in place.

How large should a follow-up sample be when testing whether a fix is working?

There is no fixed number, but the sample should scale with the finding's severity and the volume of activity. For a high-rated finding in a busy scheme, you might test 15 to 25 post-implementation files drawn from across the observation period. For a low-volume coverholder, a smaller sample covering all relevant transactions may be sensible. Always select files processed after the fix went live, and document your sampling rationale.

What is the difference between 'closed pending effectiveness testing' and 'closed'?

'Closed pending effectiveness testing' means the change has been implemented and verified as in place, but there has not yet been enough operating history to prove it works consistently. This is common for annual or infrequent controls. A finding should move to fully closed only once a later test or review confirms the control has operated as intended, and the target date for that test should be recorded.

Can remote or desktop review be used to close findings, or is a follow-up visit always needed?

Desktop review is often sufficient for low and medium-rated findings where the evidence is documentary or can be extracted from systems, such as updated procedures, referral logs or bordereaux samples. A follow-up visit is better suited to high-severity findings, repeat issues or situations where you doubt the quality of the evidence supplied. A risk-based approach lets you reserve visits for where they add the most assurance.

What are common mistakes to avoid when closing audit findings?

The most frequent mistakes are accepting a new procedure as proof the control works, closing findings on management's word alone, and treating the completion of a task as the same as fixing the root cause. Others include failing to record partial closure honestly, letting risk acceptance happen without insurer sign-off, and not tracking repeat findings. Checking that evidence addresses the original root cause helps avoid most of these.

How should repeat findings be treated differently from first-time findings?

Treat repeat findings as a sign that the previous remediation did not address the root cause, and consider raising their severity rating. Review why the earlier fix failed, whether through poor design, weak oversight, staff turnover or lack of resources, and require stronger evidence for closure, such as a larger sample over a longer period. Report repeat issues separately at portfolio level so patterns across coverholders are visible.

Otter Audit