What it is
A deficiency is not fixed when the action is implemented. It is fixed when the remediated control has operated long enough for a retest to show it works. This tracker follows each deficiency from identification through remediation, retest and closure.
It measures days overdue from the revised date where one exists and counts revisions, so repeated slippage is visible. A summary shows status, classification and aging for the audit committee.
When to use it
- After management or internal audit evaluates deficiencies.
- For monthly status reporting to the CFO and the quarterly report to the audit committee.
- Before the year-end evaluation, to see what has to be retested.
What’s inside
- Tracker for up to 50 items with root cause, action, dates and retest
- Calculated due date used, open flag, days overdue and aging bucket
- Checks for closed without retest, not effective and no owner
- Summary by status, classification and aging
Standard cited
This template follows SOX 404 / COSO monitoring. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
When can I close a deficiency?
When the remediated control has been retested and found effective. Closing on implementation alone leaves the possibility that the fix does not work.
Why track revised dates?
A target that keeps moving is a signal. The tracker counts revisions and the summary shows items revised twice or more, so a repeat slip is easy to see.
Related templates
- ICFR Management Deficiency Aggregation Matrix
- SOX Testing Status Dashboard
- Root Cause Analysis (5 Whys and Fishbone)
- Management Action Plan Response Form
Last updated 11/05/2026. All free templates.