Purpose 

This guidance explains how departments should develop the initial Corrective Action Plan (CAP) after an audit report is issued. 

An initial CAP should clearly explain what the department will do to address each audit recommendation, who is responsible, when the corrective action will be completed, and what planned supporting documentation will show completion. 

Why Initial CAPs Matter 

Initial CAPs help the university: 

  • Connect planned corrective actions to the audit recommendation and related risk. 
  • Set clear expectations for ownership, timing, and planned supporting documentation. 
  • Document management’s planned approach before corrective action work begins. 

A strong initial CAP helps make sure everyone understands what corrective action will be taken, who is responsible, when it should be completed, and what planned supporting documentation will show completion. 

Developing the Initial Corrective Action Plan 

This section explains what departments should include in the initial CAP for each audit recommendation. 

At a Glance: Required Initial CAP Elements 

Each initial CAP should include: 

  • A corrective action for each audit recommendation. 
  • A responsible party or primary owner for each corrective action. 
  • A realistic target completion date. 
  • Key dependencies or phased steps, if applicable. 
  • Planned supporting documentation expected to show completion. 

When the Initial CAP Is Due 

After the final audit report is issued, Internal Audit will provide the initial CAP template to the department through SharePoint. Unless Internal Audit provides different instructions, the department should complete the initial CAP within 30 days of receiving the template. 

The initial CAP should include enough detail for Internal Audit to understand how the department plans to address each audit recommendation. Departments should contact Internal Audit as early as possible if they have questions about the recommendation, template, due date, or expected level of detail. 

How to Submit the Initial CAP 

When the initial CAP is complete, departments should notify Internal Audit by email at ia@umw.edu that the CAP is ready for review in SharePoint. If the department has questions about how or where to submit the initial CAP, it should contact Internal Audit before the due date to help avoid delays. 

Approval Before Submission 

Before submitting the initial CAP, the appropriate department leader or designee should review and approve it for accuracy, feasibility, and alignment with the audit recommendation. If the corrective action affects multiple offices or needs senior-level support, the department should confirm that the appropriate leader or responsible official has reviewed the planned corrective action. 

How the Audit Report, Management Response, and CAP Work Together 

The audit report, management response, and CAP each have a different purpose: 

  • The audit report describes the observation, related risks, impacts, and Internal Audit’s recommendation. 
  • The management response documents management’s overall agreement, partial agreement, disagreement, and context related to the observation and recommendation. 
  • The initial CAP documents the specific corrective actions management will take, including responsible parties, target completion dates, and planned supporting documentation. 

The initial CAP should match the management response and directly address the final audit recommendation. If circumstances have changed, the initial CAP should explain what changed and what the department will do instead to address the risk. 

Expectations for the Initial CAP 

A complete initial CAP should include the following information for each audit recommendation: 

1. Corrective Action 

Describe the specific corrective action or actions management will take. The action should be clear enough for someone outside the department to understand what will change. 

A strong corrective action should: 

  • Directly address the audit recommendation and the underlying risk. 
  • Describe what will be developed, revised, implemented, reviewed, or monitored. 
  • Identify whether the action involves a new process, revised procedure, training, system change, documentation standard, review control, or other improvement. 
  • Be specific enough to allow progress to be tracked. 
  • Be realistic based on available staffing, systems, timing, and dependencies. 

Avoid vague statements such as “will review,” “will improve,” or “will monitor” unless the CAP explains what will be reviewed, improved, or monitored; who will do it; how often it will happen; and how it will be documented. 

At a minimum, the initial CAP should clearly explain what will change, who is responsible, when the action will be completed, and what planned supporting documentation will show completion. 

For example: 

Too vague: “The department will improve the review process.” 

Clearer initial CAP detail: “The department will update the review checklist, assign a supervisor to complete the monthly review, require the completed checklist to be saved in SharePoint, and begin using the revised process by October 31.” 

2. Responsible Party 

Identify the person or position responsible for ensuring the corrective action is completed. If more than one office or person is involved, identify the primary owner and any supporting parties. 

The responsible party should have enough authority to coordinate the work, get needed input, and keep the action moving. If more than one department is involved, the CAP should clearly state who is accountable for the action. 

3. Target Completion Date 

Provide a realistic target completion date for each corrective action. The date should reflect the time needed to design, approve, implement, and document the corrective action. 

When setting target dates, consider: 

  • The complexity of the corrective action. 
  • Required approvals or coordination with other offices. 
  • Technology, staffing, budget, or procurement dependencies. 
  • Training or communication needs. 
  • Whether implementation should be phased. 
  • Whether the corrective action can reasonably be completed within 12 months. 

If a corrective action cannot reasonably be completed within 12 months, the CAP should explain why and identify interim milestones or phased actions. 

4. Planned Supporting Documentation 

The initial CAP should identify the planned supporting documentation the department expects to provide when the corrective action is complete. This helps everyone agree up front on what will show the work was done. 

Examples of Corrective Actions 

Examples of planned supporting documentation may include updated procedures, training records, review logs, approval records, screenshots, monitoring reports, or other records that show the corrective action was implemented. 

Example 1: Procedure Documentation 

Audit recommendation: Develop written procedures that define required review steps, documentation expectations, and responsible parties. 

Stronger corrective action: “The department will create written procedures for the monthly reconciliation process. The procedures will explain who prepares and reviews the reconciliation, what documentation is required, where records will be saved, and when each monthly review should be completed. The department director will approve the procedures before they are used.” 

Example 2: Training and Communication 

Audit recommendation: Ensure staff are trained on updated procedures and documentation requirements. 

Stronger corrective action: “The department will train staff who are responsible for the process. The training materials will include the revised procedure, examples of required documentation, and instructions for saving records. Attendance and training materials will be saved in SharePoint.” 

Example 3: Oversight and Monitoring 

Audit recommendation: Establish periodic review to ensure procedures are followed consistently. 

Stronger corrective action: “The department will complete a quarterly supervisory review of selected transactions to confirm that required documentation is complete and approvals are saved. Review results will be recorded in a monitoring log, and any issues will be discussed with staff and corrected.” 

Example 4: Phased Implementation 

Audit recommendation: Implement new controls that require coordination with multiple offices. 

Stronger corrective action: “The department will complete the corrective action in three phases: Phase 1 will define roles and approval requirements; Phase 2 will update procedures and templates; and Phase 3 will train staff and begin monitoring. The initial CAP will list the planned dates, responsible party, and planned supporting documentation for each phase.” 

Initial CAP Development Checklist 

Use this checklist before submitting the initial CAP: 

  • Each initial CAP item was reviewed with the related final audit report recommendation. 
  • Each corrective action directly addresses the audit recommendation and related risk. 
  • The action is clear, realistic, and easy to understand. 
  • A responsible party or primary owner is identified. 
  • Supporting parties are identified when more than one office is involved. 
  • A realistic target completion date is provided. 
  • Any phased approach or major dependency is explained. 
  • Planned supporting documentation has been identified. 
  • Management has reviewed and approved the initial CAP for accuracy, feasibility, and alignment with the audit recommendation. 
  • The initial CAP will be submitted using the CAP template and submission method provided by Internal Audit by the required deadline. 

Common Initial CAP Issues to Avoid 

To help prevent delays, departments should avoid these common initial CAP issues: 

  • Providing corrective actions that do not address the audit recommendation and related risk. 
  • Listing broad intentions without specific actions. 
  • Leaving responsible parties unclear. 
  • Providing target dates that are unrealistic or incomplete. 
  • Treating the initial CAP as separate from the final audit report. 
  • Submitting the initial CAP without management review or approval. 
  • Submitting the initial CAP without using the CAP template or submission method provided by Internal Audit. 

Roles and Responsibilities 

Department Management 

Department management is responsible for: 

  • Developing the initial CAP. 
  • Ensuring each corrective action addresses the audit recommendation and related risk. 
  • Assigning responsible parties. 
  • Establishing realistic target completion dates. 
  • Planning corrective actions that are realistic and sustainable. 

Responsible Party 

The responsible party is responsible for: 

  • Helping define the corrective action, timing, ownership, and planned supporting documentation. 
  • Gathering input needed to develop a complete initial CAP. 
  • Helping keep the corrective action on track. 
  • Identifying planned supporting documentation expected to show completion. 
  • Notifying management and Internal Audit if the proposed action, timing, ownership, or planned supporting documentation needs clarification before submission. 

Internal Audit 

Internal Audit is responsible for: 

  • Providing the CAP template and related guidance. 
  • Answering questions about audit recommendations and CAP expectations. 
  • Reviewing initial CAP submissions for clarity, completeness, and alignment with audit recommendations and related risks. 
  • Asking for clarification when needed before the initial CAP is finalized. 

What Happens After Submission 

After the initial CAP is submitted, Internal Audit reviews it for clarity, completeness, and alignment with the audit recommendation and related risk. Internal Audit may accept the initial CAP as submitted or ask for clarification before the CAP is finalized. 

If clarification is needed, the department should respond as soon as practical so the initial CAP can be finalized. 

Final Reminders 

Initial CAPs work best when they are clear, realistic, and connected to the audit recommendation and related risk. A clear initial CAP helps everyone agree on what corrective action will be taken, who is responsible, when it will be completed, and what planned supporting documentation will show completion. 

Departments should contact Internal Audit early if they have questions about the audit recommendation, corrective action, responsible party, target completion date, or planned supporting documentation.