An audit action plan with owners, dependencies and closure evidence

An audit action plan should make the next decision clear: who will act, what must happen first, what evidence is needed and who can accept closure.

This proposed ten-field register helps public-sector managers separate a corrected transaction from a changed control. Use it to track decisions and evidence, while retaining the external auditor’s separate assessment.

Aligning Remediation with Continuous Internal Control

According to the AGSA media statement of 26 March 2026 on national and provincial 2024–25 outcomes, governance, capability, and oversight deficiencies hinder progress, requiring basic internal controls maintained throughout the financial year to address errors continuously.

To address these underlying deficiencies, management can implement structured remediation programmes that move beyond temporary transactional fixes. If an entity focuses solely on correcting individual transactional errors during year-end preparation, underlying control vulnerabilities may remain unaddressed, leading to recurring findings in subsequent financial periods. Sustainable remediation requires separating immediate adjustments from long-term modifications to systems, procedures, and oversight routines.

Management may achieve continuous control by systematically evaluating how operational procedures operate across reporting periods. When internal control activities are embedded into daily routines rather than treated as periodic compliance exercises, public sector institutions can improve the reliability of financial and performance information.

Designing the Ten-Field Recommended Action Register

To record and monitor corrective measures effectively, management can adopt a standardised action register. A comprehensive register captures both technical details and governance accountabilities, so that each identified issue can be tracked through a defined operational lifecycle. The recommended action register comprises ten core fields:

• Finding: Brief description of the observed audit finding, capturing the visible symptom, accounting error, or instance of non-compliance.
• Root-Cause Hypothesis: Diagnosis separating surface-level transaction errors from underlying systemic failure or breakdown in controls, processes, or oversight.
• Control Objective: The specific risk-mitigation outcome required to prevent reoccurrence of the finding.
• Accountable Owner: A single named role responsible for directing and delivering the corrective action.
• Action: Specific remediation activities to be performed to fix the control breakdown and correct underlying records.
• Dependency: Prerequisites, systems, budget approvals, or third-party inputs required to execute the action.
• Due Date: Target completion timeline for full implementation of the corrective measure.
• Evidence: Observable, verifiable documentation required to demonstrate that the control is operating effectively.
• Reviewer: Designated internal authority tasked with verifying evidence and assessing control functionality.
• Closure Decision: Formal status determination based on objective evidence review.

Remediation progress across these fields should be tracked using five suggested lifecycle statuses: open, underway, awaiting evidence, verified for management closure, and reopened.

An audit action plan with owners, dependencies and closure evidence is vital to clarify that achieving verified for management closure reflects internal operational verification within the organisation. Internal management verification does not dictate, constrain, or guarantee the independent auditor's final statutory conclusions or reporting.

The independent financial statement audit has its own mandate and opinion; AGSA explains its audit process and reporting.

— Synthesis of National Treasury and AGSA guidance

Illustrative Worked Example of a Complete Register Entry

The following table provides a hypothetical and illustrative worked example demonstrating how the ten fields can be applied to an administrative control breakdown within a public sector context. This scenario is strictly illustrative and does not represent actual institutional performance data or historic audit findings.

This illustrative example shows how establishing root causes, explicit dependencies, and defined physical or digital evidence trails allows internal reviewers to verify control implementation objectively before marking an issue closed.

Preserving Closure Evidence and Respecting Auditor Independence

Sustaining audit readiness requires diligent records management. Management is responsible for organising financial and operational records, preserving original source documents, maintaining complete version histories, and enforcing authorised access controls. Proper document preservation helps keep evidence available when an action is verified for management closure, the underlying evidence remains accessible, legible, and uncorrupted for future evaluation.

Institutions must maintain a clear conceptual distinction between management readiness support and the external independent audit. Audit readiness support encompasses management's internal preparation, including organising records, reconciling balance sheet accounts, and documenting internal control activities. The independent financial statement audit has its own mandate and opinion; AGSA explains its audit process and reporting.

Internal readiness testing and sampling should be tailored specifically to the entity's unique risk profiles and reporting periods. Management should avoid applying arbitrary or universal sampling rules, ensuring instead that evidence preservation directly supports the specific internal controls being evaluated.