Read the signal, not the schedule
Every audit committee sees the same table each quarter: open recommendations, ageing brackets, a handful of items shaded red. The conventional reading is administrative — a list to be chased. The accurate reading is diagnostic. A recommendation that management accepted, committed to, and then left open through eight reporting cycles is evidence about how the organisation behaves when nobody is forcing it to act.
Consider what an aged item actually proves. The risk was real enough for management to accept the finding rather than dispute it. The fix was concrete enough to carry a date. And the organisation then demonstrated, repeatedly and in writing, that missing a commitment to the audit committee carries no consequence. That third fact is the governance problem — and it is contagious, because every function watching learns the same lesson.
An overdue action register is the most honest document an audit committee receives. It records not what the organisation says about accountability, but what it does when a commitment becomes inconvenient.
Why actions age: the three usual mechanics
Behind most stale registers sit three mechanics, usually in combination. Ownership drift: the action was assigned to a role, the incumbent moved on — common in airlines, where restructuring is frequent — and the successor inherited neither the context nor the commitment. Escalation without teeth: the item is escalated from the audit report to the tracker to the committee pack, but escalation only changes which document the item appears in, never what happens to the person responsible. Polite fictions: revised dates are accepted without challenge, so the register records a series of agreed extensions rather than a series of failures — and an item that has slipped four times is displayed with the same status as one slipping for the first time.
Note what is absent from that list: audit quality. There are certainly recommendations that age because they were impractical, and the reset below deals with them. But an audit committee that assumes impracticality as the default explanation is choosing the comfortable diagnosis over the likely one.
Airlines add a mechanic of their own: the open items that age longest tend to sit in cross-functional territory — revenue integrity between commercial and finance, station controls between ground operations and treasury, data quality between IT and everyone. Where a finding has no single natural owner, it defaults to the department least able to refuse it rather than the one best placed to fix it, and the register quietly fills with orphans.
Questions that expose the real position
The ageing table itself will not tell you which mechanics are at work. These questions, put to management and the CAE in committee, usually will:
- Which open items have had their target date revised more than once — and who approved each revision?
- For the ten oldest items, can the accountable executive — not the CAE — explain the current status without notes?
- How many closed items were verified closed by audit re-testing, rather than closed on management’s assertion?
- Has any item ever been formally accepted as a risk the organisation will carry — with the acceptance minuted at the right level — rather than left nominally open?
- Do overdue audit actions appear anywhere in executive performance objectives or remuneration discussions?
The last question is usually decisive. Where the answer is no, the register is a record of unenforced promises, and its ageing profile is exactly what that arrangement predicts.
Resetting the regime
A credible reset has four parts, and boards should insist on all of them. First, triage the backlog honestly: every aged item is either still warranted (re-dated once, with an accountable executive named in person, not by department), overtaken by events (closed with the reason minuted), or a risk the organisation chooses to carry (formally accepted at executive or board level — visible risk acceptance being entirely legitimate, silent non-delivery being the thing to abolish). Second, verify closures: a sample of items closed on assertion should be re-tested by internal audit, because a register that overstates closure is worse than one that admits delay. Third, attach consequence: repeated slippage on agreed actions belongs in the executive performance conversation, and the committee should say so explicitly. Fourth, change what the committee sees — less list, more pattern: slippage counts, repeat-extension items, verification rates and the ageing trend, so the committee tracks the behaviour, not merely the inventory.
Where to start
Ask for one addition to the next committee pack: the ten oldest open recommendations, each showing the original date, every revised date, and the name of the accountable executive. That single page — typically uncomfortable, always informative — makes the governance question unavoidable, and the reset conversation tends to follow of its own accord. Where it does not, an independent review of the register and the follow-up regime gives the committee the evidence to force it.