Compliance remediation after audit or supervisory findings

Short answer: A compliance remediation plan turns every finding from an audit or supervisory review into an action with a root cause, an owner, a due date and evidence defined in advance. An action is only closed once that evidence has been checked and signed off by the responsible function, not when a document has been revised. For banks in Germany, the BaFin minimum requirements for risk management (MaRisk, AT 4.4.3 para. 11) require internal audit to monitor that identified deficiencies are remedied on time.

This guide is for heads of compliance, chief risk officers and general counsel in Switzerland and Germany who need to address findings from internal audit, the external auditor or the supervisor. It shows how to prioritise findings, set up an action plan, evidence closure and steer the team.

Where findings come from and what they require

Findings usually come from four sources: internal audit, the external audit firm, the supervisory authority or the compliance function's own testing. The higher the source, the stricter deadlines and evidence requirements tend to be.

• Internal audit: in Germany, internal audit at credit institutions must monitor timely remediation of deficiencies under MaRisk AT 4.4.3 para. 11, with a follow-up audit where necessary. If material deficiencies are not remedied within a reasonable time, the head of internal audit first informs the responsible management board member in writing and, at the latest in the next overall report, the full management board.
• External auditor: findings from the regulatory audit are recorded in the audit report and followed up in the next audit. In Switzerland, FINMA Circular 2025/1 "Audit" governs regulatory audits; the form and deadline of the follow-up are set out in the relevant audit report.
• Supervisor: in Switzerland, under Art. 31 of the Financial Market Supervision Act (FINMASA), FINMA restores compliance with the law where a supervised entity breaches supervisory law or other irregularities exist. Under Art. 36 FINMASA it can appoint an investigating agent, including to implement measures it has ordered. In Germany, BaFin can appoint a special representative under section 45c of the Banking Act (KWG) who, among other things, monitors compliance with its orders.
• Own testing: deficiencies found in compliance monitoring belong in the same action plan; under MaRisk AT 4.4.2 the compliance report must also cover deficiencies and the measures to remedy them.

Prioritising findings

Prioritise findings by severity, deadline and dependencies, not by their order in the report. A simple grid:

1. Adopt the severity rating: the auditor's rating (for example high, medium, low) is the starting point.
2. Assign deadlines: dates set by the supervisor take precedence over internal ones.
3. Determine the root cause: several findings often share one cause, such as unclear responsibilities or a missing system field. Fixing the cause can then close several findings.
4. Make dependencies visible: plan early for actions that depend on IT changes, data or management decisions.
5. Check capacity: assess whether the internal team can deliver the actions on time alongside day-to-day work.

Setting up the compliance remediation plan

The remediation plan links every finding to a concrete action, evidence, an owner and a due date. The table shows examples; findings and dates are assumptions.

Break each action down into concrete work steps and evidence requirements. An action register should contain at least: finding ID, root cause, action, owner, due date, status, evidence, evidence reviewer and sign-off.

When is an action closed?

An action is closed when the agreed evidence is available, has been independently checked and has been signed off by the responsible function. A revised document is not yet an effectively implemented action. Agree in advance:

• what evidence is needed and in what form;
• who checks it, ideally someone who did not implement the action;
• who signs off closure;
• whether, beyond design, effectiveness must be shown over a period of time.

This prevents tasks from being closed only on paper and reopened at the next audit.

Evidencing remediation to auditors and supervisors

Auditors and supervisors expect traceable, complete and dated evidence that can be understood without explanation. An evidence pack per finding works well:

• a short description of the finding, root cause and action;
• proof of implementation, such as approved documents, system extracts or minutes;
• the result of the quality review or effectiveness test;
• dated sign-off by the responsible internal function;
• remaining residual risks and who accepted them.

Tell the auditor or supervisor early if a deadline cannot be met, and state the reason, the new date and interim measures. What the supervisor requires in an individual case follows from the specific order or audit report.

Team and governance for remediation

A remediation programme needs clear governance and enough capacity for both remediation work and quality assurance. Plan remediation work, quality assurance and formal sign-off as separate tasks. Typical roles:

• Programme owner: head of compliance or CRO; reports to management and the audit committee.
• Project lead or PMO: runs the action register, tracks deadlines and dependencies.
• Remediation analysts: work through files, alerts or process documents; junior to experienced profiles depending on the finding.
• Quality assurance: experienced compliance officers review samples against fixed criteria.
• Business owners: sign off actions in their area and own residual risks.

Alpinum Solutions provides compliance and legal professionals for this through staff leasing or freelancing, as individuals or as a taskforce, part-time or full-time. In one anonymised assignment, a taskforce of eight compliance officers (8 FTE) including a team lead worked on KYC remediation at a financial institution in Switzerland under staff leasing; the team lead reported to the internal compliance function, and the project was completed within ten months (KYC taskforce case study). Our guides on KYC remediation planning and legal and compliance taskforces show how to set up such a team.

What belongs in the brief?

For a first enquiry, structured information without sensitive case data is enough:

• type and scope of the findings, such as number and severity;
• deadlines and who set them;
• affected processes and systems;
• existing action plans and internal governance;
• profiles needed, workload, languages and place of work.

At the end, the handover should include an updated action register, organised evidence, documented reviews and clearly named open decisions.

Limits and risks

• Responsibility for remediation stays with management and business owners. External professionals carry out and review work but do not accept residual risks.
• If root causes are not fixed, findings return at the next audit.
• Client and transaction data are confidential. Access, storage and data protection must be settled before the start.
• Alpinum is not a law firm and does not provide legal advice. Questions on how to interpret orders are for the legal department or external advisers.

Frequently asked questions about compliance remediation

Who is responsible for remediation?

Responsibility lies with management; the business functions are responsible for implementation. The compliance function or a programme office steers the action plan and reports progress. Internal audit independently monitors whether deficiencies are remedied on time; for German credit institutions this is expressly its task under MaRisk AT 4.4.3 para. 11.

What evidence does the supervisor expect?

The supervisor expects proof that an action has not only been decided but implemented and is effective. That includes approved documents, system extracts, review records, test results and sign-off by the responsible function. What is sufficient in an individual case follows from the order or audit report. If in doubt, agree the form of evidence with the auditor early on.

What happens if a deadline cannot be met?

Inform whoever set the deadline early and in writing, with the reason, a new date and interim measures. At German credit institutions, internal audit must report material deficiencies not remedied in time to the responsible board member and, at the latest in the next overall report, to the full management board under MaRisk AT 4.4.3. Silent delays damage the trust of auditors and supervisors.

How many people does a remediation programme need?

That depends on the number and type of findings, the deadlines and internal capacity. Individual policy or process findings can often be handled by one experienced professional. Large-scale rework, such as on KYC files or alerts, needs a team with analysts, quality assurance and a team lead. Extrapolate the effort from a sample before you fix the team size.

Can remediation be supported externally?

Yes. Interim professionals often take on remediation work, quality assurance or project management while the internal team continues day-to-day business. Under staff leasing, the company gives the professional instructions; under freelancing, the professional works independently within the agreed mandate. Sign-offs and residual risks always remain with the company.

Next step

Describe your findings, deadlines and available capacity. Selected profiles are usually available within 48 hours; the company and Alpinum agree the start date together.

• Interim compliance
• AML and KYC remediation
• Building a compliance management system
• Discuss your needs

Last updated: 31 October 2026.