Audit Findings Tracker: See Whether Your Handover Is Still Holding Six Months Later

The Audit Findings Tracker does one job. It tracks findings from all audits through to closure, with owners, severity and corrective actions attached to each one.

That job belongs in Sustain. By the time you are auditing, the solution is built, the controls are written and the process has been handed to the people who run it every day. Audits are how you check that the handover held. Findings are what the audits produce. The tracker is where those findings live until somebody closes them.

You reach for it when you have more than one audit type running and no single place to see the leftovers. A Kamishibai check raises one thing. A layered audit raises another. A compliance review raises two more. Each of those lives in its own record, and each is easy to lose. The tracker pulls them into one list so that a finding cannot quietly expire.

Use it on a cycle, not once. Open it after each round of audits, add the new findings, update the ones that have closed, and read the counts. The counts are what tell you whether the improvement is still alive or whether it is drifting back.

Everything in this guide uses the sample data that ships with the tool. The case is fictional. It is built to look like a real accounts payable improvement a few months after handover, and it is detailed enough to show you how to read the output.

The picture is a process that is mostly behaving. Five findings sit in the tracker. They came from four different audit sources: a Kamishibai check coded K-03, a compliance review, a 5S check and a layered Level 2 audit. That mix matters. It means the process is being looked at from several angles, not just one.

The findings themselves are small. Two payment exceptions sat for more than twenty four hours. One OCR quality check was missed out of twenty. An obsolete document was still in circulation. A board was updated one day late. Two approvals went through manually.

None of those is a crisis on its own. Together, across four audit types, they are the ordinary residue of a live process. The question the tracker answers is not whether findings exist. Findings always exist. The question is whether they get closed.

The table takes one row per finding. Three fields are mandatory: the finding ID, the finding itself and the status. The rest are optional, but each one you skip removes something from the result.

In the sample, the IDs run AF-01 to AF-05. A simple sequence is enough. What matters is that the ID never changes once it is issued, because you will refer to it in meetings for months. The audit column records where the finding came from. Writing Kamishibai K-03 rather than just Kamishibai lets you trace a finding back to a specific check.

The finding column should be short and factual. The sample entries are good models: 2 exceptions >24hrs, OCR QA missed (1/20), Obsolete doc, Board 1 day late, 2 manual approvals. They state what was observed with a number where a number exists. They do not state a cause and they do not state a fix.

The action column is where the fix goes. Investigate approver. Coach operator. Remove and file. Coach supervisor. Update delegation matrix. Each is a verb and an object. The owner column carries a role, not a person: AP Manager, Green Belt, AP Clerk. Roles survive staff changes. The due date and the status finish the row.

From those five rows the tool returns a short set of counts. There are 5 findings. 2 of 5 are closed. 3 are open. 2 are open at medium severity or higher. 3 are past their due date.

Read those in pairs. Five findings against two closures tells you the closure rate is behind the raising rate. Three open against three past due tells you that every open finding has already blown its date. That is the sharper number. It means nothing in this tracker is simply in progress. Everything that is open is late.

The open set is AF-01, the two exceptions over twenty four hours, at medium severity and due 2025-06-10. AF-04, the board one day late, at low severity and due 2025-06-14. AF-05, the two manual approvals, at medium severity and due 2025-06-20. The two closed items are AF-02, the missed OCR quality check, and AF-03, the obsolete document.

The tool also offers an AI review that explains the result in plain language. Use it as a second reading, not as a replacement for looking at the rows yourself.

The first decision is about ownership load. Of the three open findings, AF-01, AF-04 and AF-05 all sit with the AP Manager. The two closed findings sat with the Green Belt and the AP Clerk. That pattern is a decision point. Either the AP Manager needs the load redistributed, or the findings need to be sequenced so that one is worked at a time.

The second decision is about sequencing by severity. Two of the three open findings are medium: AF-01 and AF-05. AF-04 is low. If capacity is short, the medium items move first and the low item gets a new, honest date rather than being left to rot behind its original one.

The third decision is about the audits themselves. Two findings came from the compliance review, AF-02 and AF-05. One of those is closed and one is open. One finding each came from the Kamishibai check, the 5S check and the layered audit. A spread like that suggests the audit mix is working. If every finding came from one source, you would ask what the other audits are failing to see.

The fourth decision is whether to escalate. Three past due out of five is the signal. It does not tell you to escalate. It tells you to ask why three dates were set and three dates were missed.

Slipping rarely announces itself. It shows up as counts that move in one direction over several cycles. Watch for the open count growing while the closed count stands still. Watch for the past due count approaching the open count, which is exactly what the sample shows at three and three.

Watch for repeat findings. If a finding similar to AF-01 appears again in the next Kamishibai check after AF-01 is closed, the corrective action did not hold. The tracker will not flag that for you. You have to read the finding text across cycles.

Watch for severity creep. Two open at medium severity or higher is a number to track over time. If that number climbs while the total holds steady, the nature of what you are finding has changed even if the volume has not.

Watch for owner concentration. One role holding every open finding, as the AP Manager does here, is a queue, not a plan.

The most common mistake is marking a finding closed when the action is done rather than when the result is verified. AF-02 closed on a coaching action. Coaching is done the moment it happens. Whether the quality check is now being completed is a separate question that the next audit answers.

The second mistake is vague findings. If AF-05 had been written as approval process needs tightening, nobody could tell when it was fixed. Two manual approvals is checkable.

The third mistake is leaving a passed date untouched. AF-01 was due 2025-06-10 and is still open. Leaving the original date makes the past due count honest, which is useful. Quietly rewriting it makes the count meaningless. If the date must move, move it deliberately and note why.

The tracker counts. It does not judge. It will tell you that three findings are open and three are past their date. It will not tell you whether those three matter. AF-04, a board updated one day late, and AF-01, two payment exceptions held beyond twenty four hours, are both open and both past due. The tracker treats them as one count each. Only the severity column separates them, and you set that column yourself.

It will not tell you whether a corrective action was any good. Investigate approver is recorded as the action for AF-01. The tracker holds the words. It has no view on whether an investigation is the right response or whether it was ever done properly.

It will not find the findings. It only holds what your audits raise. If the Kamishibai checks are being signed without being performed, the tracker will look healthy and the process will not be. A low open count can mean strong closure or weak auditing, and the tool cannot distinguish between the two.

It will not establish cause. Five findings across four audits may share one root cause or five. The tracker does not group them. That analysis belongs with your root cause tools, and the tracker is only the list that prompts you to run them.