Sharp. Not sentimental.
The Regulator Found It. Internal Audit Had Found It Eighteen Months Earlier.
A financial services firm received a supervisory finding on its third-party risk governance. The regulator's assessment identified three specific gaps: inconsistent risk classification across business lines, absence of a named decision-maker for third-party risk acceptance, and evidence of controls that could not be produced without reconstruction.
The firm's governance team pulled the internal audit report from eighteen months earlier. It identified the same three gaps, using different language: 'taxonomy inconsistency across business units,' 'unclear escalation authority for vendor risk,' and 'control evidence requiring assembly prior to review.'
The language was different. The findings were identical. The gap between the internal audit finding and the regulatory finding was eighteen months of governance activity that had not resolved the structural issues the internal audit had identified.
Nobody had connected the internal finding to a decision that would close it.
Honest. Not accusatory.
Internal Governance Findings and Regulatory Findings Describe the Same Gaps. The Distance Between Them Is Time and Consequence.
Regulatory examinations are not random. They are structured around the same principles of sound governance that internal audit, risk oversight, and board governance are supposed to uphold. When a regulatory finding appears, it is almost always a gap that the organisation's own governance functions could and should have identified first.
The question is not whether internal governance finds these gaps — it usually does. The question is whether the findings connect to decisions that close them.
An audit finding that produces a remediation plan is not the same as an audit finding that produces a decision. A remediation plan describes activity. A decision states a specific change, names the person responsible for making it, and sets a timeline that is tracked until the gap closes. Most audit findings produce remediation plans. Fewer produce decisions.
Simple. Not simplistic.
The Internal-Regulatory Alignment Test: Three Questions to Ask Before the Regulator Does.
Before the next regulatory examination, three questions can reveal whether your internal governance is finding and closing the same gaps the regulator will look for.
| QUESTION | WHAT A STRONG POSITION LOOKS LIKE | WHAT THE REGULATORY RISK LOOKS LIKE |
|---|---|---|
| Are your current open audit findings cross-referenced against your risk taxonomy? | Each finding maps to a risk class. The risk owner knows about it. The board risk report references it. | Findings exist in an audit register that is separate from the risk register and the board report. Nobody has connected them. |
| For each open finding, is there a named decision — not a remediation plan — with an owner and a close date? | A specific change has been decided, someone owns the execution, and the next review has a scheduled date. | A remediation plan exists. Nobody owns the specific decision. The close date has been extended twice. |
| If you compare your current open findings to your last regulatory feedback, how many themes overlap? | Zero or near-zero overlap. Internal governance is finding and closing issues before the regulator sees them. | Significant overlap. The regulator is consistently finding gaps that internal governance had also found but not closed. |
The third question is the most revealing. Persistent overlap between internal findings and regulatory findings is not bad luck. It is evidence that the governance model is finding gaps and not closing them — and that the regulatory consequence is the mechanism that eventually forces closure.
Practical. Not obvious.
Cross-Reference Your Open Audit Findings Against Your Last Regulatory Feedback.
Pull your current list of open internal audit findings and your most recent regulatory feedback — supervisory letter, examination summary, or equivalent.
If the overlap is low and the gaps are recent, your internal governance is ahead of regulatory observation. Document that position — it is a governance strength worth evidencing.
If the overlap is high and the internal findings are older than twelve months, the finding-to-decision chain is broken. The gap the regulator found was visible internally for a year or more. That is the architecture problem worth fixing before the next examination.
Open. Not pushy.
The Audit-Ready Proof Checklist
18 items across four sections. The finding-to-decision chain maps directly to Section A — evidence of the decision — where most regulatory findings originate.
Access here →Book a 45-Minute Decision Architecture Conversation
If the cross-reference exercise produced significant overlap between internal findings and regulatory feedback, the diagnostic session maps where the finding-to-decision chain is breaking and what connecting it requires.
Book a diagnostic session →That's The Decision Layer for this week.
The firm's regulator did not find something the internal audit had missed. It found something the governance model had found and not closed. That distinction matters for where the fix needs to go.
Forward this to a Chief Audit Executive or Head of Compliance who has ever received a regulatory finding on something their function had already flagged. It's more common than anyone likes to admit.