Overdue Risk Findings: Five Barriers to Sustainable Remediation
Updated: Sep 3
Financial institution audit and risk leaders, often struggle to resolve audit, regulatory, anti-money laundering (AML), compliance and risk findings. Management actions may remain overdue, issues may recur, or findings may be closed without evidence that remediation is effective and sustainable.
This is more than an administrative concern. Persistent findings can increase regulatory exposure, contribute to customer or financial harm, weaken operational resilience and divert management attention from strategic priorities.
In this article we discuss five common barriers which contribute to this challenge and suggest practical strategies aimed at reducing long-standing open risk findings.
1. Limited Appreciation of the Value of Control Functions
Audit, risk and compliance functions are sometimes viewed primarily as cost centres rather than as contributors to sound governance, resilience and sustainable performance. This perception can reduce the priority given to remediation and weaken cooperation between control functions and operating departments.
The Institute of Internal Auditors’ Three Lines Model clarifies the responsibilities of each organisational line:
First line—operational management: Owns risks, operates controls and manages day-to-day risk exposure.
Second line—risk and compliance: Provides expertise, frameworks, monitoring, guidance and constructive challenge.
Third line—internal audit: Provides independent and objective assurance on governance, risk management and controls.
Effective coordination across the three lines is essential to ensure that findings are understood, appropriately prioritized and resolved by accountable business owners.
Practical Strategies:
Reinforce that risk ownership rests with the business, not solely with risk or compliance.
Provide cross-functional training to reduce organisational silos.
Establish regular forums for business, risk, compliance and internal audit to discuss significant findings.
Consider secondments or staff rotations to improve knowledge transfer and collaboration.
2. Insufficient Understanding of Risk and Its Operational Impact
Risk affects every function of a financial institution, but employees may not understand how weaknesses in their processes contribute to broader financial, regulatory, conduct, operational or reputational risk.
Where risk is viewed as the responsibility of a specialist function, remediation may be treated as a compliance exercise rather than as a necessary measure to reduce actual exposure.
Practical Strategies:
Provide risk-based training, prioritizing higher-risk departments and activities.
Implement departmental risk and control self-assessments.
Require management to periodically confirm that key risks and controls have been identified and are operating effectively.
Include the quality and sustainability of remediation in relevant management objectives.
Performance measures should focus on effective risk reduction—not simply on the number of findings closed.
3. Poorly Defined or Unclear Findings
Findings may remain open because management does not clearly understand the issue, the associated risk or the required remediation. Reports that are unclear, incomplete or overly broad can delay decision-making and create disagreement.
A high-quality finding should be:
Clear: Written in straightforward, jargon-free language
Complete: Supported by evidence and linked to the relevant policy, regulation or control expectation
Concise: Focused on the key issue and its implications
Each finding should also identify the root cause, risk impact, accountable owner, required remediation, target date and evidence needed for closure.
Practical Strategies:
Require consistent standards for drafting findings.
Discuss significant findings with management before finalisation.
Ensure risk ratings and their implications are clearly understood.
Define closure evidence at the time the action plan is agreed.
4. Unresolved Disagreements Between Business and Control Functions
Constructive challenge is an important feature of a healthy control environment. However, disagreements about the existence, severity, ownership or remediation of a finding can prevent mitigation action from starting.
Practical Strategies:
Identify disputed findings early.
Distinguish factual disagreements from differences in professional judgement.
Establish a documented escalation process for unresolved matters.
Require interim controls or other risk-mitigation measures where significant exposure remains.
Escalate material disputes to the appropriate risk, audit or executive committee.
The objective should be a documented and shared understanding of the risk—not the avoidance of challenge or premature closure.
5. Limited Remediation Capacity
Findings may remain open because departments lack sufficient personnel, expertise, funding or management capacity. This is particularly common when subject-matter experts are supporting multiple regulatory, operational and transformation initiatives.
Resource constraints should not, however, result in significant risks remaining unmanaged for extended periods.
Practical Strategies:
Prioritize remediation according to risk, regulatory significance and potential customer or financial impact.
Allocate specialist resources to the highest-risk findings first.
Establish target timelines by risk category. For example:
High risk: generally, within three months
Medium risk: generally, within six months
Lower risk: generally, within twelve months
Require formal approval for extensions and risk acceptance.
Monitor the effectiveness of interim or compensating controls.
These timelines are illustrative and should be aligned with the institution’s risk appetite, regulatory commitments and the nature of each finding.
Executive Metrics
Senior management and governing committees should receive concise reporting on a small number of indicators, including:
Overdue findings by risk rating and accountable business unit
Average time to remediate findings
Repeat or reopened findings
Percentage of findings closed with validated evidence of sustainable remediation
Number of extensions, risk acceptances and findings reliant on interim controls
Metrics should distinguish between findings genuinely remediated and those closed through risk acceptance or temporary mitigation.
Conclusion
Overdue audit, regulatory, AML, compliance and risk findings typically reflect a combination of weak ownership, insufficient risk awareness, unclear reporting, unresolved disagreements and limited remediation capacity.
Business, audit and risk leaders can improve outcomes by:
Reinforcing accountability across the Three Lines Model
Ensuring that findings are clear, risk-based and actionable
Resolving disputes promptly through defined escalation channels
Directing scarce resources to the highest-risk issues
Requiring evidence that remediation is effective and sustainable
At the center of these actions is open, constructive communication. Business, risk, compliance and internal audit teams must maintain a shared understanding of the institution’s key vulnerabilities and work together to reduce exposure to an acceptable level.
Comments