At a previous employer, my procedure for follow up on audit exception items was to track moderate to high findings on a spreadsheet that included a "due by" date based on high, medium, low. I would followup with the department manager around the due date. The manager actually provided me with a "this is where I'm at" response. Reported to the Audit Committee semi-annually on the status. The next audit told the tale. It worked great. Examiners thought it was acceptable. I also think it kept the manager accountable.

Current employer, wants me to test for completion and basically re-audit. I simply don't have the time for that with all of the other duties I perform, not to mention keep up with reg changes. I think the manager should be accountable for reporting on what they have done to correct any identified issues. Of course, where there is high risk, there are frequent audits/reviews, which can serve as followup. I understand that.

But, I'll be open for suggestions! I would love to know how other track audit exception items.

Your previous employer had a better grasp on things.

I don't think it makes sense to re-audit, but I also think that you need some sort of verification process that the issue was properly addressed. For example, if it was a training issue, obtain the agenda from the training meeting.

I set up a "validation file," which was at the suggestion of our examiners long ago. I maintain any evidence that the finding was appropriately addressed in that log. For some issues the evidence is more tangible (i.e., was a policy/procedures updated per the recommendation) and for some the "this is where I'm at/this is what was done" response from management is what I use.

This from the Fed:

The audit department should determine
the reasonableness, timeliness, and completeness
of management’s response to their recommendations,
including follow-up, if necessary.

Oh,yes! In the past, I had requested some sort of documentation to support removing an item from the tracking list. Example, if the manager said he/she would review reconciliation, then part of the documentation was reconciliations with manager's signature and date of review. and so on...