Recurring Finding
Definition
An audit finding that has appeared in two or more consecutive audit cycles despite previous remediation commitments. Recurring findings indicate that the root cause was not addressed by the prior corrective action and warrant root-cause analysis before a new MAP is issued.
- Context
- Audit and remediation tracking
- Threshold
- Two or more consecutive audit cycles
- Signals
- Root cause not addressed
- Typical response
- Root-cause analysis, new MAP
Common questions
Why does a recurring finding call for root-cause analysis rather than simply repeating the same corrective action?+
If a finding returns despite an earlier remediation commitment, the earlier fix likely addressed a symptom rather than the underlying process or control gap, so auditors push for analysis of why the original management action plan failed before accepting a new one.
How does an auditor typically escalate a recurring finding compared to a first-time finding?+
Escalation often includes tighter follow-up timelines, involvement of more senior management or the audit committee, and a requirement that the new corrective action plan explain specifically why the previous remediation did not hold, rather than treating it as a routine repeat item.
Related terms
- Closure Evidence
- Documentation that demonstrates a finding has been remediated. Acceptable evidence types vary by control: updated policies with effective dates, configuration screenshots, vulnerability...
- Finding Owner
- The individual or team accountable for implementing the corrective action specified in a management action plan. The finding owner is typically the...
- Follow-Up Verification
- An independent check, usually by internal audit or the compliance function, that reviews closure evidence and confirms the control gap has been...
- Management Action Plan (MAP)
- A formal document issued in response to an audit finding, recording the agreed corrective action, the accountable owner, the target closure date,...
- Risk Acceptance
- A formal decision by an authorised senior manager to tolerate a finding without full remediation, typically because the cost of remediation exceeds...