NFRA's 90-Day Remediation Plan Rule: What Audit Firms Must Prepare
NFRA's Audit Quality Inspection Guidelines, updated up to 30 April 2026, create a practical clock for inspected audit firms: submit a remediation plan within 90 days of the inspection report, and provide compliance with all inspection findings no later than 180 days.
That changes the way firms should think about inspection readiness. A weak audit file is no longer just a file problem. It becomes a firm-level remediation project with deadlines, root-cause analysis and follow-up in the next inspection.
What exactly changed?
The updated NFRA guidelines say the inspection report may require the auditor to perform root-cause analysis for deficiencies and send the results and action taken to NFRA. They also say the inspected auditor must submit a remediation plan within 90 days of the inspection report.
The compliance deadline is also explicit: compliance with all inspection findings in the detailed inspection report must be provided within the prescribed timelines, but no later than 180 days from the date of issue of the inspection report, whether detailed or otherwise. Extensions need justification and NFRA approval.
In working language:
| Milestone | What it means |
|---|---|
| Draft report response | Response to draft inspection report within 10 days |
| Remediation plan | Plan submitted to NFRA within 90 days of inspection report |
| Compliance evidence | Findings complied with no later than 180 days |
| Next inspection | NFRA follow-up on observations will form part of recurring inspections |
This is not a ceremonial requirement. It creates a documented trail of whether the firm understood the deficiency, identified the cause, changed the system, and proved the change.
Why this matters beyond Big Four firms
NFRA inspections formally target auditors within NFRA's jurisdiction, especially public interest entities. But the inspection pattern affects the whole profession because it sets the visible benchmark for audit quality.
Peer reviewers, audit committees, larger clients and quality-conscious partners read the same signals:
- Was the audit evidence sufficient?
- Was the audit documentation understandable to an experienced auditor?
- Were firm-level quality controls operating, or only written in a manual?
- Were independence, consultation, review and engagement acceptance controls evidenced?
- Did the firm fix repeated issues, or explain them away?
The 90-day remediation plan is therefore useful even if your firm is not currently inspected by NFRA. It is the discipline every firm should apply after an internal cold review.
What goes into a remediation plan?
A defensible remediation plan has five parts.
1. The finding, stated plainly
Do not paraphrase a deficiency until it becomes harmless. State what was found: missing evidence, weak documentation, insufficient review, independence process failure, unresolved contradiction, incomplete testing, or unsupported conclusion.
The plan should quote or map the finding precisely enough that a reviewer can trace it back to the inspection report.
2. Root cause
Root cause is not "staff error." That is usually a symptom.
Better root-cause categories:
| Symptom | Possible real root cause |
|---|---|
| Working paper missing review notes | Review sign-off checklist did not require evidence of challenge |
| Revenue testing too narrow | Firm methodology over-relied on prior-year approach |
| Contradictory evidence not resolved | No required step for contradiction clearance before conclusion |
| Independence documentation incomplete | Client acceptance workflow not integrated with engagement setup |
| Same issue repeated across files | No monitoring loop from cold review to training and template changes |
NFRA's inspection model looks at the firm's system of quality control, not only the selected file. Your root cause should do the same.
3. Remediation action
The action must change the system. Training alone is rarely enough.
Useful actions include:
- Update the audit programme or working paper template.
- Add mandatory fields for procedure nature, timing, extent and conclusion.
- Add review prompts for contradictory evidence.
- Require source-document references for every material figure.
- Introduce cold reviews for high-risk areas.
- Change client acceptance checklists.
- Create a dashboard for unresolved review points.
- Document consultation requirements for complex areas.
The action should be specific enough that someone can test whether it happened.
4. Owner and deadline
Every remediation item needs an owner. "Audit team" is not an owner. Use a role: engagement partner, quality partner, independence partner, methodology owner, training owner, IT/admin owner.
The deadline should fit inside the 180-day compliance window. If the fix affects live engagements, set an earlier internal deadline so the change is used before the next file closes.
5. Evidence of completion
NFRA will not be persuaded by "implemented" as a word. The plan should say what evidence will prove completion:
- revised template version and date,
- training attendance and materials,
- sample completed working papers using the revised procedure,
- independence confirmations,
- cold review report,
- issue tracker export,
- partner sign-off,
- system access logs,
- quality dashboard screenshots.
That evidence should be preserved centrally, not buried in individual engagement folders.
The 180-day problem: you cannot fix old audit evidence
The hardest truth is that a deficient completed audit file cannot be made clean after the fact.
SA 230 permits administrative completion and later changes only with clear documentation of what changed, when, by whom and why. Adding missing evidence after an inspection finding is not the same as having performed and documented the procedure at the time.
So remediation should focus on:
- explaining the root cause,
- correcting the methodology,
- changing current and future engagements,
- proving that the new control operates,
- and documenting why the same deficiency should not recur.
Trying to rewrite the past is dangerous. Building a system that prevents recurrence is the point.
How AI and audit software help
Technology is useful here only when it creates evidence of control operation.
The most valuable automation for remediation is not a chatbot that drafts explanations. It is a workflow that shows:
- which procedures were completed,
- which exceptions remain unresolved,
- who reviewed the working paper,
- when review points were raised and cleared,
- whether source documents tie to figures,
- whether late changes happened after file assembly,
- which files have repeated quality issues.
That is the bridge between NFRA inspection readiness and SQM 1 monitoring and remediation. The firm needs a repeatable system, not heroic clean-up after the report arrives.
A 90-day remediation plan template
Use this structure after an NFRA inspection, peer review, cold review or internal quality review.
| Field | What to write |
|---|---|
| Finding ID | Number from inspection report or internal review |
| Area | Independence, engagement performance, documentation, evidence, review, methodology |
| Standard / policy affected | SA, SQC/SQM, Code of Ethics, firm manual |
| Finding summary | Plain-language deficiency |
| Root cause | Process, training, methodology, review, system, capacity |
| Remediation action | Specific change to template, workflow, control or training |
| Owner | Named role |
| Due date | Internal date within 90/180-day clock |
| Evidence | What proves the action happened |
| Operating test | How the firm will test the fix on live files |
| Status | Open, in progress, implemented, tested, closed |
The final two columns matter most. A remediation action is not complete when the policy is rewritten. It is complete when the firm can show the revised control operated on an engagement.
Frequently Asked Questions
What is NFRA's 90-day remediation plan requirement?
Under NFRA's Audit Quality Inspection Guidelines updated up to 30 April 2026, an inspected auditor must submit a remediation plan to NFRA within 90 days of the issue of an inspection report.
What is the 180-day NFRA compliance deadline?
The inspected auditor must provide compliance with all inspection findings within the timelines prescribed in the detailed inspection report, but no later than 180 days from the issue date of the inspection report unless NFRA approves an extension.
Does an NFRA inspection report prove professional misconduct?
No. NFRA's guidelines state that inclusion of an observation in an inspection report is not a determination of professional misconduct. It may still lead to enforcement or investigation in certain cases, but the inspection report itself is not an adjudication.
Should smaller firms use the same remediation format?
Yes. Even if NFRA does not inspect your firm, the same format works for peer review, internal cold reviews and SQM 1 monitoring. The discipline is the same: finding, root cause, action, owner, evidence, operating test.
Sources: NFRA, Audit Quality Inspection Guidelines (updated up to 30.04.2026); NFRA inspection reports and public inspection framework.
Try CORAA -> Audit workflow, working papers and review trails built so deficiencies are visible before inspection season. See pricing · NFRA quality review guide · SQM 1 checklist.