Risk discovered during audit prep

[kanbanking]

While getting ready for an internal audit, we came across an outdated process that has some unmonitored risk exposure. This is now affecting our timeline. How do you usually handle situations like this?

 

[FriedClamz]

While getting ready for an internal audit, we came across an outdated process that has some unmonitored risk exposure. This is now affecting our timeline. How do you usually handle situations like this?

my advice is that you need to immediately document the unmonitored risk and put a temporary mitigation plan in place.
This shows the audit team that you are taking the finding seriously. Then, I would communicate with the audit lead to explain the discovery and propose a revised timeline.
It's better to be transparent about the issue and have a solid plan to fix it than to try and rush through a halfbaked solution

 

[DPM.Ann]

While getting ready for an internal audit, we came across an outdated process that has some unmonitored risk exposure. This is now affecting our timeline. How do you usually handle situations like this?

That's frustrating, and I agree with @FriedClamz that the key here is transparency and immediate risk mitigation. You must formally update your Risk Register right away, fully documenting the outdated process and quantifying the severity of the unmonitored exposure. Then communicate the risk discovery adn revised timeline immediately with all stakeholders. Frame the delay as a necessary stop to ensure compliance, not just a problem. Also implement a temporary control, like a quick workaround or an extra manual check to mitigate the unmonitored risk to an acceptable level as soon as possible. This lets the audit prep proceed while you plan the permanent process fix separately!

 

[Handela]

To say the least, document the risk, notify stakeholders, and put a temporary control in place if possible. Then adjust your audit plan to account for the exposure so you stay on track without ignoring the issue