What a Repeat Finding Reveals

Recurrence is not an old issue returning. It is new evidence about the institution itself.

Institutions are often better at identifying weaknesses than at changing the conditions that produce them. An audit raises a finding, management accepts the recommendation, responsibility is assigned and an action plan follows. Depending on the issue, a policy may be revised, guidance issued, training delivered or a new review process introduced. Eventually, the action is marked complete and the institution can point to a formal sequence showing that the problem was detected and addressed. The more revealing moment comes when the same weakness appears again.

By then, the institution is no longer dealing only with the original control failure. It has already had an opportunity to understand the problem, decide what to do about it and implement a response. Recurrence therefore adds a second layer of evidence. It shows whether the institution can convert what it learns into a durable change in practice.

That distinction matters because much of the architecture of integrity is built around detection. Audit, monitoring, safeguards, evaluations, complaints mechanisms and independent review all exist partly to make weaknesses visible before they cause greater harm. But visibility is not the same as correction. An institution can have active assurance functions, detailed action trackers and regular management reporting while allowing the same weaknesses to persist underneath them.

A repeat finding should therefore be read differently from a first finding. The first tells us something about the condition of a control. The second begins to tell us something about the condition of the institution around that control.

Recurrence is evidence

The Audit Office of New South Wales provides a useful recent example. In its 2026 review of internal controls and governance across 26 of the state’s largest agencies, repeat findings accounted for 42 percent of all audit findings, up from 33 percent the previous year. The Audit Office said the increase indicates that vulnerabilities remain unaddressed.

The importance of that figure lies not simply in the volume of unresolved issues. These were weaknesses that had already entered the formal assurance process. They had been identified, documented and communicated. In many cases, management would have been expected to respond. The figure cannot show which repeat findings had been closed and which were still open. A weakness that is still open has not yet been addressed. A weakness that returns after closure raises a harder question, because the response itself did not hold.

The NSW report concerns public-sector internal controls, and the main repeat areas it lists are IT general controls, outdated policies and procedures, and payroll and workforce management. It is offered here as an illustration of how recurrence can be read, not as evidence about climate finance. The application to climate-finance institutions is a matter of reasoning, and the sections that follow develop it.

Recurrence therefore reveals something that the original finding could not. It may indicate that the initial diagnosis was incomplete, that responsibility was unclear, that corrective action was not adequately resourced, that management attention faded after the initial response, or that the action was closed before anyone established whether the underlying condition had actually changed.

Professional internal-audit standards reflect this distinction. The Institute of Internal Auditors’ Global Internal Audit Standards do not treat communication of results as the end of the assurance process. Principle 15 also addresses monitoring action plans, recognizing that the value of a finding depends partly on what happens after it has been reported.

The deeper point is that an institution does not demonstrate its ability to manage weakness merely by finding it. It demonstrates that ability by changing the condition that allowed the weakness to persist.

The false comfort of action plans

Consider a hypothetical climate-finance program in which procurement reviews repeatedly identify weaknesses in supplier due diligence. Ownership information is incomplete, supporting documentation is inconsistent and the basis for some supplier selections is difficult to reconstruct. The first review produces recommendations, management agrees with them, procurement guidance is strengthened and staff receive additional instructions. Once those actions are completed, the recommendation is formally closed. A year later, another review identifies essentially the same weaknesses.

At that point, treating the issue as unfinished implementation may be too narrow. The institution already knew about the problem and already responded. The recurrence suggests that the response either did not address the real cause or did not hold once ordinary pressures returned.

The possible explanations are quite different from one another. The institution may have treated a capability problem as a documentation problem. Staff may understand the procedure but operate under incentives that favor speed over scrutiny. Responsibility for checking compliance may be unclear. Exceptions may be too easy to approve. The recommendation may have been closed when the new process was introduced rather than when there was evidence that practice had actually changed.

Each explanation points to a different institutional weakness and therefore to a different response. More training will not solve unclear accountability. A revised procedure will not correct incentives that consistently reward speed over challenge. A new checklist will not help if nobody has authority to insist that it be followed.

This is where action trackers can become misleading. “Guidance issued,” “training completed” and “procedure updated” are legitimate management actions, but they are outputs. They do not necessarily establish that the risk condition has changed. A recommendation can therefore be administratively complete while the weakness it was meant to address remains alive in practice.

Closure is not the same as correction

The difficulty arises when completion of the agreed action becomes the proxy for effectiveness. Many weaknesses are not primarily procedural. They may reflect weak incentives, fragmented accountability, limited authority, insufficient capacity or a culture in which exceptions are tolerated more easily than challenge. In those circumstances, a procedural response may be fully implemented and still leave the underlying condition intact.

That is why recurrence should be treated as evidence in its own right. It may show that the original response was too narrow, that the cause was misunderstood or that the institution lacked the authority or capability needed to sustain the correction. It may also reveal that closure criteria were too focused on whether an activity had been completed rather than whether the control had become more effective.

For climate-finance institutions, this matters because assurance often operates through long delivery chains. A weakness may first become visible at project level, through an implementing entity, contractor or intermediary, while the mechanism producing it sits elsewhere in the institutional architecture. If the response focuses only on the place where the problem surfaced, the recommendation may be closed without addressing the condition that continues to generate it.

A repeat finding can therefore change the level of analysis. What initially appeared to be a discrete control weakness may, through recurrence, begin to look like an institutional one.

The second finding should not produce the same response

The first appearance of a weakness usually justifies a direct corrective response. The second should trigger a deeper examination of the response itself. At that point, the institution needs to determine whether the original diagnosis was accurate, whether the agreed action addressed the underlying cause or only its visible symptoms, whether implementation was tested after closure, and whether the people responsible for correction had the authority and resources needed to make it stick.

This is what makes repeat findings potentially useful indicators of institutional condition. Their value lies not only in showing that a weakness remains, but in revealing whether the machinery designed to respond to weakness is functioning as intended.

The Audit Office’s finding that rising repeat findings indicate unaddressed vulnerabilities is sensible, because unresolved vulnerabilities leave institutions exposed. But monitoring should not end with whether an action has been completed. Where the same issue returns, recurrence itself becomes part of the evidence that management needs to understand.

For climate finance, that distinction is particularly important. Projects and institutions often operate through complex delivery arrangements over long periods. A recurring weakness in procurement, monitoring, safeguards, reporting or accountability may therefore be more than an isolated control problem. It may indicate that the institution is struggling to turn assurance into institutional learning.

Recurrence as evidence of institutional learning

Institutions understandably track open findings, overdue actions and closure rates. A stronger approach would also ask whether the condition that produced the finding has changed. That may require testing after closure, comparing apparently separate findings for common causes, examining whether the same weakness appears across projects or business units, and escalating recurrence rather than simply reopening the original action.

At that point the repeat finding becomes more than an audit-management issue. It becomes evidence of institutional learning, or the lack of it. An organization that repeatedly detects the same weakness without altering the conditions that reproduce it may have a functioning assurance process, but its learning loop is weaker than its reporting suggests.

Integrity is not protected by the existence of findings, recommendations or action plans. Those mechanisms matter only if they help the institution become different after the weakness is known.

A repeat finding should therefore not be treated as an old issue returning. It is new evidence about the institution itself. When a weakness has been identified, accepted and supposedly addressed but still reappears, the problem is no longer confined to the original control. The recurrence tells us that something between detection and correction is not working. For an institution serious about integrity, that is not a reason to reopen the same action plan. It is a reason to examine the machinery of response.

References

1. Audit Office of New South Wales (2026). Internal Controls and Governance 2026: Grants, Consultants, Purchasing Cards and Technology. 12 August 2026.

2. The Institute of Internal Auditors (2024). Global Internal Audit Standards. 2024 Edition.

About the Author

Ame I. Odaro-Adjei advises on the governance frameworks, control systems, project safeguards, and institutional arrangements that protect financial integrity and support credible climate finance delivery. Her background spans global investment banking, international development, and multilateral climate finance, including leading the compliance function of the world’s largest dedicated multilateral climate fund. She specializes in anti-money laundering, counter-terrorist financing, sanctions compliance, ethics, anti-corruption, and anti-fraud. She is a qualified attorney.