# Audit Findings, Responses and Closure Register

Track A and Track B · Neutral documentation bundle

## Purpose

Maintain one traceable record per finding from draft through management response and independent closure review, preserving disputed facts and residual matters.

## Intended user

Audit practitioner and authorised audit reviewer; management supplies responses, owns actions and requests closure.

## When to use

When a finding is drafted, a response is received, an action changes or closure evidence is submitted. Stage-specific empty fields are allowed and explained.

## Included templates

- **Finding, response, action and closure record**.

## Shared evidence/provenance and human-review fields

Complete this cover once per working-paper record. Repeat only where the scope or reviewer changes. Local review rows should reference the shared decision ID when the same decision covers them; record only view-specific judgement or a different decision there, not duplicate names/dates. A role label alone may not identify the actual reviewer: use the responsible person or institution-controlled reviewer reference in the authorised record, without unnecessary personal data in provider inputs. Use source IDs in individual rows rather than copying the full evidence inventory. Blank is not a pass; use “not supplied”, “not performed”, “unclear”, or “not applicable — reason” accurately.

| Field | Definition / professional purpose | Entry |
|---|---|---|
| Record ID and objective | Local working-paper reference and the decision/question this record supports; not a newly assigned AMO ID | — |
| System/process and period | Exact unit, system baseline and period examined; bounds the conclusion | — |
| Source register | Evidence ID; permitted locator; version/date; source owner; date obtained; scope/access limitation. A cited document not inspected stays “not inspected” | — |
| Preparer and work state | Responsible preparer role; date; distinguish proposed, performed and supplied third-party work | — |
| Reviewer decision | Reviewer identity/reference and authority; date; exact record/version reviewed; decision ID and rationale; restrictions. Leave unrecorded until a person decides | — |
| Unresolved matter / follow-up | Missing or conflicting evidence; affected decision; next request/action; owner/date only if supplied | — |
| Approved carry-forward | Exact edited material authorised for the next activity, linked to review decision and remaining limitations; no automatic approval | — |

Suggested review states describe this document only: draft, awaiting evidence, returned for revision, held, or reviewed for the stated limited use. They do not change any application schema or establish an engagement conclusion. An action status is recorded separately from an evidence or reviewer status.

## Field definitions and fillable templates

Each table is a blank working view. Duplicate a view or its item rows only for a distinct system, test, claim or event. Keep related evidence under stable IDs.

### Finding, response, action and closure record

| Field | Definition / purpose | Entry |
|---|---|---|
| Finding ID / stage / scope | Local issue ID, current stage and relevant process/period; no premature closure label. | — |
| Criterion / condition | Applicable source requirement and actual supplied observation, each with locator; missing criterion stays missing. | — |
| Cause / effect or risk | Corroborated cause/actual impact separate from hypotheses/potential consequences. | — |
| Evidence / disagreement / limit | Source IDs, contradictory evidence, management disagreement and scope/inference limits. | — |
| Recommendation and response | Auditor suggestion separate from exact management position and rationale. | — |
| Action / owner / due date | Specific management commitment, accountable owner authority, dependency and agreed date only if supplied. | — |
| Completion assertion / evidence | Reported action completion separate from implementation and subsequent operation evidence. | — |
| Closure criteria / retest | Supplied criteria and proportionate validation under the audit method (inspection, re-performance, follow-up test or other stated method); actual result or evidence unavailable/not performed as appropriate. | — |
| Reviewer decision / residual matter | Authorised decision with date and rationale, remaining risks/actions and any separate risk-acceptance record. | — |

**Completion guidance:** Use AMO-P-000363 at the applicable stage; do not populate future response/closure fields with invented commitments. Management may validate facts but does not approve the audit reviewer's conclusion. Closure needs a reasoned decision, not an automatic status change.

## Bundle completion guidance

Keep the same finding reference through revisions. Record what changed and retain the earlier disputed statement by reference. Reporting extracts should carry scope, criterion, evidence limitation and unresolved matter. A due date passing, a reminder or a management completion statement does not close the issue. Record remediation evidenced, residual risk accepted by the authorised risk owner, and administrative closure as separate matters. A risk-acceptance or administrative decision is not a finding that remediation worked; retain its authority, rationale and open consequences. No universal retest or closure rule is invented by this form.

Before carrying material forward, reconcile the question, criterion, source and actual observation. Preserve original evidence in the institution's authorised repository. Use only permitted excerpts in an AI surface; do not paste private credentials or unapproved identifiers. Local saving is not evidence custody or permission to disclose to a provider. A proposed test or a completed form cannot stand in for a recorded result.

The audit supervisor decides sufficiency and reliance; the specialist decides matters within their competence and authority. Management validates its own representations and owns corrective action. Management agreement is not the audit reviewer's independent closure decision. Carry-forward remains editable and requires explicit review.

## Example completed synthetic excerpt

Finding CA-F1 (synthetic local reference), stage response/closure challenge. Criterion: CA-04 clause 2. Condition: CA-06 AC-09 shows approval later than issue, with exception record unavailable. Cause: not established. Effect: no actual harm evidenced; risk of unauthorised release remains a hypothesis for review. Response: CA-08 says reminder sent and requests closure. Owner: process owner offers coordination; precise commitment/due date absent. Closure/retest: no retest supplied. Decision: CA-09 does not approve closure. Carry-forward: obtain exception and subsequent-operation evidence; retain limited observation and unknown extent.

This is an illustrative entry from the bundled fictional case, not work performed on a real organisation. Review dates/decisions shown as proposed must not be represented as real sign-offs.

## Limitations

- Not a shared action-management system or automatic reminder tool.
- Risk acceptance, reporting and closure require authorised human decisions under the applicable methodology.
- A completed action can leave the original risk or evidence gap unresolved.
- This is a supplied-evidence review aid. It does not perform an audit, issue an audit opinion, establish control effectiveness, certify anything, determine legal compliance or grant professional approval. The authorised audit professional retains judgement and reliance decisions. Use only information permitted for the selected provider; local encrypted storage does not itself authorise provider disclosure.

## Related Amo.ng resources

**Prompts:** [AMO-P-000194 — Internal SOP Gap and Control Mapping Brief](https://amo.ng/prompts/internal-sop-gap-control-mapping-brief) v1.0.0; [AMO-P-000071 — Evidence-Grounded AI Output Verification and Release Gate](https://amo.ng/prompts/ai-output-verification-checklist) v2.0.0

**Workflows:** [AMO-W-000021 — Assure an AI System Change for Production Release](https://amo.ng/workflows/ai-system-change-production-release-assurance)

**Skills:** [AMO-S-000016 — Trace Consequential Claims to Original Evidence](https://amo.ng/skills/trace-consequential-claims-to-original-evidence)

These are complementary methods, not additional proof of the same claim. Read their current source boundaries; open their normal resource pages for the full instructions. Existing resources and their verification status remain unchanged.

## Related audit Prompts and Workflow

- [AMO-P-000363](https://amo.ng/prompts/challenge-audit-finding-management-response-closure-claim) is the bounded challenge method.
- [AMO-W-000044](https://amo.ng/workflows/evidence-controlled-internal-audit-working-paper) carries only human-reviewed wording into the final working paper.

Use of these resources is subject to the [Amo.ng Terms](https://amo.ng/terms).