Statutory requirement
By statute, OSC is required to monitor the implementation of our recommendations and conduct a follow-up review. To meet this requirement, every auditee must submit a corrective action plan to our office within 90 days of the audit report release.

What is a corrective action plan?
OSC audits contain recommendations on how an auditee can improve its operations or internal controls. A corrective action plan, or CAP, is exactly what the name implies – it is the auditee’s plan to correct what our audit determined was deficient or in need of improvement.

What is the process?
After the audit report is issued (Audit Resources: What is an OSC Audit?), OSC sends the auditee a CAP template. After the auditee fills in the required information, the CAP is sent back to our office.
Upon receipt, audit management will review the CAP. This review is important because it provides our office an opportunity to review the plans before they are executed. This allows us the opportunity to determine if the proposed corrections will have the desired effect. Further, we can contact the auditee at an early stage to discuss any issues and changes that may be necessary to ensure the recommendation is implemented when we return for our follow-up review. If an auditee is uncooperative in submitting an acceptable CAP, we are required by statute to inform the Governor, the President of the Senate, and the Speaker of the General Assembly.

What are the components of a good CAP?
The CAP should answer three questions: What steps will the auditee take to implement the recommendations? Who in the organization will be responsible for implementing each recommendation? When will these steps be executed?
Each corrective action should be described in adequate detail to clearly demonstrate the improvements that have occurred or are planned in response to each recommendation. Each recommendation should also include the person who will be responsible for executing the recommendation and the implementation date. If any recommendations were not implemented, the auditee should provide a reasonable explanation why action was not taken. To be considered effective, the corrective actions must be appropriately designed to rectify the conditions described in our audit report.

Why is a CAP important?
A CAP is important because it identifies opportunities for improvement and provides for the development of corrective actions; it is, in essence, a roadmap to help the auditee save money, make their operations more efficient, or comply with the law. A CAP is also important because it holds the auditee accountable. The auditee develops steps to implement each recommendation and is then responsible for following through on those steps.

What Comes Next?
OSC is statutorily required to follow up and report on an auditee’s progress in implementing the recommendations within three years of issuing the audit report. The follow-up review will assess what progress has been made and what still needs to be done. The follow-up review ensures accountability from the auditee.

The primary objectives of the follow-up review are to determine whether the recommendations were implemented as described in the auditee’s CAP and if the actions taken are operating as intended to remedy the finding.

During the follow-up review, the audit team performs the appropriate testing, evaluation, and verification to determine the adequacy, effectiveness, and timeliness of the actions taken by the auditee to implement the recommendations. After performing our review, OSC will consider a recommendation fully implemented, partially implemented, or not implemented. When all recommendations are implemented, the audit cycle is complete.

But, what happens if our recommendations are not implemented? Pursuant to statute, OSC must provide notice to the Governor, the President of the Senate, and the Speaker of the General Assembly when an auditee has not fully implemented and complied with our recommendations.

A recent example of noncompliance occurred in the follow-up of the North Bergen School District. North Bergen’s unwillingness to implement or fully implement 13 of 15 recommendations indicated that it had not taken OSC’s recommendations seriously and did not fully comply with its own CAP. In this case, OSC will continue to monitor our recommendations and we directed North Bergen to submit further information regarding its compliance with our recommendations every 90 days until further notice.

Noncompliance with the CAP and follow-up process is rare. It is important to note that most auditees welcome the chance to work with OSC in order to improve their operations, ensure compliance with laws, and save the taxpayers money whenever possible.