Every audit findings tracker on page one is the same blank form: a finding, a due date, an evidence field. The stronger guides go further and say to validate two separate things before closing a finding, that the fix addresses the root cause and that it actually holds under real conditions. None of them start from an issued letter. Every one asks the finding to be retyped from the report by hand, which is how a preparer's paraphrase drifts from the auditor's own wording a little more each year.
Halbrook Precision Components, Inc., an illustrative CNC machining manufacturer audited annually to satisfy a lender's reporting covenant, reads its FY2025 letter into a register of three findings under the auditor's own numbers. Each one gets a remediation plan with a named owner and a target date. The Evidence Index then tracks two things separately: an artifact proving the fix exists, and a dated, real instance proving it actually caught what it was built to catch. AU-C 265 draws exactly this line between a deficiency in a control's design and one in how it actually operates.
One of the three recurs: despite a checklist adopted within weeks, two live terminations still missed the access-removal window, 45 and 61 days late. AU-C 265.A26 is why that recurrence itself matters: a deficiency management fails to remedy can need to be communicated at a higher severity than it carried the first time. The FY2026 letter reclassifies this one a material weakness. The other two findings closed on or ahead of target, a 67 percent first-pass remediation rate the register states directly rather than only counting rows marked done.
Audit Finding Remediation Plan Template