The ATR is rebuilt every quarter
Someone collates status from several trackers and a mail chain each cycle, and the version presented is only as good as that week's responses.
Action Taken Report
Every observation, from any source, tracked to an evidence-backed closure
The Action Taken Report is the part of governance that most often runs on email. This module makes it a register instead: every observation — from internal audit, control testing, statutory and tax audit, regulatory inspection or management review — becomes an action with an owner, a due date and a defined closure standard. Closure requires evidence and a reviewer's acceptance, and the quarterly ATR is produced from the register rather than compiled the week before the meeting.
Where it usually goes wrong
Most teams know how to do this work. The trouble is that it lives in workbooks, mail threads and shared folders, and keeping them in sync becomes a job of its own.
Findings from different sources live apart
Internal audit, statutory audit, tax and regulatory observations sit in separate files, so nobody sees the total open position for a process owner.
Closure is asserted, not evidenced
An item is marked closed on a verbal confirmation, and the same issue is raised again at the next audit.
Overdue items surface late
Nothing escalates on its own, so slippage is discovered in the meeting rather than in the month it happened.
With ATR
- One register for observations from every source
- A named owner and a due date on every action
- Reminders and escalation running without manual chasing
- Closure only against evidence accepted by a reviewer
- Repeat observations flagged against their original finding
- The ATR produced from live status on any date it is asked for
What ATR does
Turn audit observations and control failures into owned actions with due dates, then track them to closure. The ATR is generated from live status instead of being re-compiled by hand each cycle.
One action register
Observations from internal audit, control testing, statutory and tax audit, regulatory inspection, management review and risk treatment all land in the same register with their source retained.
- Source, reference and date carried on each item
- Created automatically from observations and failed controls
- Manual entry for external and inspection findings
Ownership and accountability
Every action carries an individual owner, a reviewer and an agreed date — not a department and a quarter.
- Individual owner with a functional reviewer
- Agreed target date recorded at the outset
- Reassignment tracked with reason and date
Priority and risk rating
Carry the rating from the originating observation so the register can be read by severity rather than by volume.
- Rating inherited from the source observation
- Regulatory and financial impact flags
- Committee views filtered to high and critical
Reminders and escalation
Owners are reminded before the due date and after it, and continued slippage escalates to the reviewer and the function head on a defined ladder.
- Pre-due and overdue reminders
- Escalation ladder by days overdue
- Scheduled digest to function heads
Evidence-backed closure
The owner submits closure evidence, the reviewer accepts or returns it, and closure is recorded only on acceptance.
- Closure evidence attached to the action
- Reviewer acceptance or return with comments
- Closure date and approver retained
Extensions on record
Where a date genuinely has to move, the extension is requested with a reason and approved — and the original date stays visible.
- Extension request with justification
- Approval by the designated authority
- Original and revised dates both retained
Repeat observation tracking
A new observation can be linked to a closed one, so repeats are visible as repeats and the closure that did not hold is on record.
- Link to the original finding
- Repeat count by process and owner
- Closure quality visible over time
Ageing and committee reporting
Ageing buckets, owner-wise positions and closure trends render live, and the formal ATR is generated for any period without re-collation.
- Ageing buckets with overdue analysis
- Owner, function and source-wise views
- Period ATR exported for the committee pack
ATR on screen
Screenshots taken from the live product.
The position on one screen
Total, closed, open and overdue actions with the closure rate against its target — the four numbers an Audit Committee asks for first — and underneath them the actions split by process, the ageing of what is overdue in day bands, and a breakdown that switches between risk, status and priority.
Every action past its deadline
Each overdue action with the observation behind it, the response management committed to, the named point of contact, the risk and priority, and exactly how far past the agreed date it has run — the register the Action Taken Report is generated from.
How a cycle runs
The steps in the order your team will actually work through them.
- 1
Capture
Observations arrive from internal audit, control testing and external sources, carrying their reference and rating.
- 2
Assign
An owner, a reviewer and an agreed date are recorded, along with the action management has committed to.
- 3
Act
Owners update progress against the action, with reminders running before and after the due date.
- 4
Evidence
The owner submits the evidence that supports closure rather than a status statement.
- 5
Review and close
The reviewer accepts the evidence and closes the item, or returns it with comments and a revised date.
- 6
Report
The ATR, the ageing analysis and the repeat-observation summary are generated for the Audit Committee from live status.
What you have at the end
The records the module produces, and the regulations and frameworks they help you meet.
Reports and records
- Period Action Taken Report for the Audit Committee
- Open and overdue action register
- Ageing analysis by bucket, function and source
- Owner-wise and function-wise status dashboard
- Closure evidence file per action
- Repeat observation summary
- Extension and reassignment log
- Closure trend and turnaround analysis
Built around
- Companies Act 2013 — Sec 177(4)
- Supports Audit Committee review of internal audit findings and their follow-up.
- SEBI LODR — Reg 18 and Schedule II Part C
- Follow-up reporting on internal audit observations for listed entities.
- ICAI Standards on Internal Audit
- Monitoring and reporting of prior audit issues, in line with the SIA framework.
- IIA International Professional Practices Framework
- Monitoring progress on communicated results until resolution.
These references describe the context the module is designed to support. They are not a statement of certification, and do not replace professional judgement on your reporting obligations.
Who works in it
Everyone works on the same record. Each person sees the part they are responsible for.
- Audit Committee and Board
- Read the ATR, the ageing position and what has not moved since the last meeting.
- Internal audit
- Owns the register, validates closure quality and flags repeats.
- Action owners
- Update progress and submit the evidence that supports closure.
- Function heads
- See their open position and receive escalation on sustained slippage.
Questions we usually get
Don't see your question here? Write to us and we'll answer it for your setup.
Can we track findings that did not come from internal audit?
Yes. Statutory audit, tax audit, regulatory inspection, management review and risk treatment actions can all be recorded with their own source reference, so the committee sees one consolidated position.
Who can mark an action closed?
Owners submit closure with evidence; closure itself is recorded only when the designated reviewer accepts that evidence. Returns are logged with comments, so the history of a disputed closure is visible.
How does the quarterly ATR get produced?
It is generated from the register for the period selected, with the opening position, movements, closures and remaining open items, so the pack reconciles to live data rather than to a separately maintained sheet.
Can owners be reminded automatically?
Yes. Reminders run before and after the due date, and an escalation ladder notifies the reviewer and the function head as an item ages past defined thresholds.
See ATR on your own data
Book an hour with our team. We will run the module on your own process and control matrix, so you can see how a full cycle would look for you.
Other RiskMan GRC modules
View the full product- Enterprise Risk ManagementA live risk register feeding heat maps and management reporting.
- Risk Based Internal AuditPlan by risk, approve the plan, assign it process-wise and execute it.
- Control TestingRun a testing project end to end — RCM, IDR, testing, approval, management response and report.
- Policy and SOPOne library for policies and SOPs, with versions and approvals tracked.
- Global SOXFor groups testing the same SOX controls across many entities. One control library, one approved scope, and projects that end in a signed-off report.