We are a public holding company with three subsidiaries. We are supervised by 5 regulatory bodies. Currently, we tracking ALL exceptions noted by IA, External Audit, Compliance, and our regulators in Excel. The spreadsheet indicates the finding, which audit it came from, risk rating, recommendation, person(s) responsible, mgmt action plan, & target date.

We meet with management monthly to discuss the outstanding items. Our Audit Committee (holding company level) receives an abbreviated version of the document at each meeting (5x per year). The AC version details only high-risk, high-risk & stale target dates, and stale dated (> 6months).

The preparation time has become unmanageable. We spend at least 40 hours per month working on the document with adding new items and management's updates.

Is anyone using a different method to achieve the same type of document? Access database? Tracking software?

We use the same process. No quite as time consuming as you are dealing with, but takes more manual time that I would like. Would be interested in alternatives as well.

If either of you are already Microsoft Office suite users, consider adding the SharePoint application. I utilize this as my issue tracker...as early as during the audit, I'll "create an issue" and assign it to the responsible party. I find this improves the communication of issues during the audit, to help create a no-surprises environment by the time of an exit conference.

SharePoint has the added functionality that utilizes Outlook, in order to email Issue Owners when a new issue is identified, notify IA that a response has been received, create custom "views" of the population of issues (based on the audience) and even allow the administrator to build customized workflows (so that issues blowing a due date automatically get their status to change to Past Due).

The reporting within it is just OK, but I've found it's saved me a great deal in issue administration time!!

Thanks for the suggestion. I will certainly speak with our IT Department about the possibility.

We actually use an automated program called AuditAlert - it tracks audit findings for us.

Basically, we enter the finding and assign a manager. The manager is prompted by an email to click on a link and enter their response and action plan. For high, moderate, and repeat findings, AuditAlert prompts the manager to provide an update quarterly until it is "fully implemented."