What Counts as Evidence That an Audit Action Is Closed?

An action owner uploads a revised procedure and changes the status to complete. The audit coordinator sees a current document, a confident completion comment and a looming committee deadline. The unresolved question is whether the action required a document, an operating control or both.

Start there. Before asking AI to write a closure summary, retrieve the original finding and the agreed action. A convincing narrative cannot establish what completion meant. If the criteria remain unclear, the first task is to resolve them with the appropriate people and preserve that decision in the file.

This article builds a closure pack for a fictional private services organisation. Its three actions, records and reviewer decisions are constructed teaching examples. No audit was performed and no AI comparison was tested. The proposed workflow is a way to organise evidence for review, not an assurance opinion or a prescribed industry template.

Read the agreement before reading the completion claim

Separate the finding from the response. The finding describes the concern identified in the engagement. The agreed action sets out what management will do about it. The closure criteria explain what the reviewer needs to see before the organisation records that action as complete. Those elements should connect, but they are not identical.

An action to publish a procedure may be complete once the agreed publication and approval evidence exists. An action to establish a working approval control asks a different question. Do not quietly add an effectiveness requirement after the owner has delivered an agreed documentation task. Equally, do not reduce an operating-control commitment to a documentation task because that is all the owner supplied.

Where the original action is ambiguous, record the ambiguity and agree the review basis through the organisation's methodology. Identify whether clarification changes the action or simply explains an existing commitment. Keep the original wording available. A rewritten action that erases the difficult part of the finding undermines the closure record.

For an internal audit function that conforms to the IIA Global Internal Audit Standards, Standard 15.2 requires internal auditors to confirm implementation through an established methodology that includes progress enquiries, risk-based follow-up assessments and updated tracking. The extent of follow-up reflects the finding's significance. This does not prescribe one universal evidence bundle for every action, and it does not endorse the AI workflow proposed here.

Give the model a criterion it can actually compare

Create a short criterion statement for each part of the approved action. Preserve the approved wording alongside it so a reviewer can see any interpretation. A useful comparison asks which supplied record addresses which criterion, what period it covers and what remains unresolved. It avoids the broad request to decide whether the action is closed.

For an approval control, distinguish its design from its use. A procedure can explain the intended approval point. A configuration record can show how the system was set up. Transaction records and a documented review may show what happened within a defined population and period. Their relevance depends on the actual action and the follow-up work selected.

Do not infer full coverage from a small collection of tidy examples. The closure reviewer needs to understand where the records came from and what they exclude. A set chosen by the action owner may be useful, but its selection basis belongs in the file. The model cannot reconstruct a missing population from the names of uploaded documents.

Use explicit evidence identifiers instead of attachment counts. Several attachments can be different exports of the same underlying record. A summary, slide and email describing one event do not become three independent confirmations. Ask the drafting tool to retain their relationships and flag repeated reliance on the same source.

Three actions, three different conclusions

In the fictional organisation, Action A concerns contractor access after an engagement ends. The agreed action requires a documented handoff and operation of that handoff during a defined review period. The packet contains the approved procedure, relevant exit records, system removal records and a reviewer workpaper explaining the population and checks performed.

The constructed comparison links the procedure to the design criterion and the records to operation during the stated period. It preserves the workpaper's limits. It does not make a claim about every contractor or future operation. The reviewer examines the underlying records and confirms that the evidence satisfies the locally agreed criteria.

The fictional reviewer then records closure, citing the evidence and its scope. This is a human decision within the constructed scenario. It is not a model-produced certification. If later events reveal a wider problem, that new information needs the appropriate review route rather than an argument that the closed status settles every future question.

Action B concerns exception review in purchasing. The agreed action requires a review process to operate across the specified review period. Management supplies a revised procedure and a training presentation. Both documents are relevant to implementation, but neither shows that exceptions were actually reviewed during that period.

A useful comparison records the support these documents provide and the missing operating evidence. It does not label the whole packet worthless. The reviewer can acknowledge completed preparation while requesting review records, the selection basis and unresolved exceptions. The constructed decision keeps the action open pending the evidence required by its agreed criteria.

Action C concerns approval of supplier changes. The agreed response was an automated approval step. Management now proposes a manual review because the planned system change is unavailable. The packet contains a revised process description and an email describing the proposed alternative, but no recorded agreement to that replacement.

The draft comparison therefore reports a scope change. It preserves the original commitment and identifies the proposed replacement as unapproved in the supplied packet. The reviewer refers it through the organisation's change process. The action does not become complete merely because the new narrative describes a feasible way forward.

Constructed closure comparison

The three rows show why a single evidence score would be misleading. Action A has a defined basis for closure. Action B lacks a particular class of evidence. Action C requires a decision about the response itself. Treating all three as percentages complete would hide the different next actions.

The implementation considerations under Standard 15.2 address an alternative plan that internal auditors agree is satisfactory or better, with progress tracked until completion. That supports maintaining a visible change trail. It does not justify a model accepting a different scope because its wording resembles the original objective.

Ask for a comparison, then challenge its gaps

Use an approved AI environment and only the material permitted for that task. Remove unnecessary personal identifiers, sensitive access details and unrelated commercial information. If a document cannot be supplied safely, record that the model did not receive it. A human can review restricted evidence without pretending the model analysed it.

Tell the model which versions control the comparison. Include the original action, approved changes, local closure criteria and a source index. Ask for one row per criterion, with the supporting evidence location and a separate uncertainty field. Require it to distinguish an owner's assertion from the record that could substantiate the assertion.

An explicit unknown is preferable to a blended conclusion. If the procedure says the review occurs monthly but the packet contains no review records, the comparison should say operation is not evidenced in the supplied material. That statement is deliberately narrower than saying the control never operated. Absence from the packet is an evidence gap, not proof of non-performance.

Review contrary evidence alongside supporting material. A completion email may conflict with an outstanding exception in a later record. Keep both references visible and resolve the conflict before drafting the final conclusion. Asking the model to produce a positive closure case invites it to organise around a desired answer.

The IIA's Standard 14.1 addresses relevance, reliability and sufficiency of information; Standard 14.6 addresses support and reproducibility of engagement documentation. Apply those requirements through the audit function's methodology. The model's comparison remains a work aid, with the auditor responsible for the evidence and reasoning it influences.

Make the human review legible

A reviewer needs to be able to disagree with the draft without rewriting the entire pack. Place the proposed conclusion beside the criterion comparison, then provide a separate decision field. Record which evidence was examined, which uncertainties were resolved and the basis for any remaining qualification. Keep the decision attributable in the controlled internal record.

The action owner and closure reviewer may have different responsibilities. Name the applicable roles from local policy instead of asking AI to choose them. Where the methodology requires independent review, convenience does not remove that requirement. The drafting exercise should expose a missing reviewer rather than assigning the action back to its author by default.

Be precise about the review period. Evidence from a newly implemented control cannot establish performance before it existed. Evidence from an earlier configuration may not establish operation after a material change. If the period is too short for the agreed conclusion, record what follow-up remains and who decides when the evidence is sufficient.

A sound file also explains relevant exceptions. An exception may be outside the action's scope, demonstrate a remaining weakness or require a revised response. The reviewer decides which interpretation is supported. The pack should make that reasoning easy to inspect instead of burying exceptions in an appendix while the front page says complete.

Report delays and changed responses honestly

When an action is late, distinguish the reason for delay from the evidence of completion. A budget constraint can explain why implementation has not progressed. It does not prove that the risk has disappeared. Preserve the explanation, revised proposal and approval route as separate records rather than resetting the due date without a trail.

Standard 15.2 requires internal auditors to obtain and document management's explanation when actions have not progressed by the established completion dates, and to discuss the issue with the chief audit executive. The standard also makes the chief audit executive responsible for determining whether senior management, by delay or inaction, has accepted a risk that exceeds the risk tolerance. Follow that governance route; an administrative status update cannot substitute for it.

For reporting, use the organisation's defined states and explain their meaning. If local terminology permits it, distinguish an owner-reported completion from audit-confirmed closure. If the system has only one completion field, retain the distinction in the controlled review record and explain the reporting limitation to those relying on the dashboard.

Avoid smoothing the narrative to satisfy a reporting deadline. A committee can act on an accurately described gap. It cannot act on a gap that has been removed from the prose. A concise statement that operating evidence is outstanding is more decision-useful than a paragraph about progress that leaves the status ambiguous.

Preserve the pack after the decision

Keep the source versions used for the review, subject to the organisation's retention and access rules. A link to a document that will be overwritten can make a later reviewer unable to reproduce the conclusion. Record the location of the controlled version or other approved preservation method; do not create uncontrolled copies of restricted evidence.

Retain the draft comparison where it materially influenced the analysis, together with corrections and the final review record. If AI mismatched an evidence item or invented a missing approval, record that failure. It identifies what to check in the next use of the workflow. A polished final summary alone conceals the weakness.

The Verified Draft Method gives the wider source-handling and human-decision pattern. In action closure, the practical addition is a criterion-level comparison that survives disagreement. Someone should be able to trace the conclusion from the original commitment through the evidence without relying on the writer's confidence.

Apply it to one disputed action

Choose an action whose completion status is currently difficult to explain. Assemble its original wording, authorised changes and evidence index. Have the responsible reviewer settle the criteria before trying the prompt. Compare the resulting draft with the sources and record every correction before anyone updates the official status.

The outcome may be closure, a targeted evidence request or a properly routed change proposal. Each is useful when supported. The objective is a decision that matches what the organisation agreed and what the evidence establishes. Give the reviewer that comparison, then let the authorised person decide.

Copyable comparison prompt

Compare only the supplied original finding, agreed action, approved changes,
local closure methodology, criteria and evidence index.
For each criterion show: exact source reference; relevant evidence IDs and locations;
what the evidence supports; period and scope; contrary evidence; missing evidence;
and questions for the authorised reviewer.
Separate owner assertions, implementation documents and operating evidence.
Do not infer missing approval, complete populations, effectiveness or acceptable risk.
Use NOT EVIDENCED IN THE SUPPLIED PACK where appropriate. Distinguish this from
proof that something did not happen. Label scope changes explicitly.
Return a draft comparison, not a closure verdict. Do not update the register or send it.
The human reviewer checks original records and records the closure decision.

Closure-pack checklist

• Original finding, action and authorised amendments retained.
• Local criteria and reviewer authority identified.
• Evidence mapped to each criterion, period and scope.
• Contradictions, exceptions and missing records visible.
• Reviewer decision, reasons and follow-up recorded.

Audit action closure working pack

Status: constructed teaching pack for a fictional private services organisation. No audit or tool test performed. Replace local criteria only through the organisation's authorised methodology; AI receives no closure authority.

Constructed source packet

LOCAL-METHOD-DEMO: The designated reviewer confirms closure against the agreed
criterion and records reasons and source references. Changed actions need authorised
agreement. This is fictional local policy, not IIA wording.
A-AGREEMENT: Implement contractor exit handoff and demonstrate operation in the agreed
review scope. A-PACK: Approved procedure, exit/removal records and reviewer workpaper
with documented population, checks, period and limits.
B-AGREEMENT: Operate purchasing exception review during the agreed period.
B-PACK: Revised procedure and training presentation. No operating records supplied.
C-AGREEMENT: Implement automated approval of supplier changes.
C-PACK: Proposed manual process and management email. No approval of replacement supplied.

Source-to-criterion table

Copyable prompt

Use only the original finding, agreed action, approved changes, local methodology,
criteria and evidence supplied. Compare each criterion with its evidence references.
Report supported points, scope, period, contrary evidence and gaps. Identify repeated
attachments derived from one source. Keep owner assertions separate from corroboration.
Do not infer missing approval, population completeness, effectiveness or acceptable risk.
Use NOT EVIDENCED IN THE SUPPLIED PACK, without treating that as proof of non-performance.
Flag action-scope changes for the authorised human process. Leave the closure decision blank.
Return a draft comparison and precise follow-up questions. Do not change status or send it.

Expected constructed review outcomes

• A: reviewer checks original evidence, records scope and closes against the fictional local criteria.
• B: reviewer acknowledges implementation documents, keeps the action open and requests operating evidence.
• C: reviewer keeps the action open and routes the proposed scope change for authorised agreement.

These outcomes illustrate different decisions. They are not outputs of an actual run or a rule that similarly named records always satisfy a criterion.

Closure checklist and decision record

Original finding/action reference:
Current authorised action version:
Applicable local criterion and methodology reference:
Reviewer authority:
Evidence location and retained version:
Population, period and selection basis reviewed:
Exceptions and contrary evidence:
Missing or inaccessible evidence:
AI comparison errors corrected:
Human decision and reasons:
Scope of closure, if accepted:
Remaining work or approved alternative:
Delay explanation and escalation reference, if applicable:
Decision date and next follow-up:

Only authorised material enters an approved tool. Exclude unnecessary personal identifiers, credentials, access secrets and unrelated commercial documents. Restricted records may remain for direct human review with their omission from the model packet explicit. Preserve controlled versions and material drafting corrections under local retention rules. This pack has not been run in a real workflow; record any actual test separately and do not label this constructed material as tested.

Related reading

• AI in Internal Audit: What Still Counts as Evidence
• The Verified Draft Method
• Inspection Notes Need a Clear Route to Action, the companion article for 8 November

References

1. The Institute of Internal Auditors: IIA: Global Internal Audit Standards, Standards 14.1, 14.6 and 15.2
2. The Institute of Internal Auditors: IIA: Standards publication page