Audit Finding Closeout · Maryland state & local agencies

Close repeat audit findings before the next report.

A finding that appears in two consecutive legislative-audit reports is no longer an audit problem; it is a management problem the auditor has documented twice. We diagnose why the last corrective action didn't hold, redesign the control and the procedure around it, train the people who run it, and track the closeout evidence until the finding is gone. Fixed scope, fixed price, and we are not your auditor, so there is no independence conflict.

Why now

Repeat findings are rising, and the response is funded.

November 2025

About a third of findings are repeats

The Office of Legislative Audits reported that roughly 34 percent of the findings in its fiscal-compliance audits were repeats of findings from the prior audit, up from about 27 percent. Some agencies carry findings that have reappeared in three or more consecutive reports.

February 2026

The audit-response directive

The Governor directed agencies to resolve outstanding audit findings and backed the directive with dedicated funding, with the Department of Budget and Management coordinating. Agencies are now being asked to show closeout progress, not just corrective-action plans.

Your next fieldwork

The auditor will test whether it held

OLA returns on a roughly three-to-four-year cycle and re-tests every prior finding. A corrective action that exists on paper but not in practice becomes a repeat finding with a longer history and more attention from the Joint Audit and Evaluation Committee.

Single-audit findings for grant recipients follow the same pattern: the federal awarding agency and the next auditor both start from last year's schedule of findings, and a repeat finding is flagged as such.

A quick self-check

Can your agency answer these today?

If a finding has been open through more than one report, most of these will be hard to answer with a document. That is the gap a closeout engagement fills.

  1. For each open finding, can you name the root cause in one sentence, separate from the symptom the auditor described?
  2. Is the corrective action written as a control someone performs on a schedule, with a named owner, or as an intention?
  3. Has the procedure behind the control been rewritten since the finding was first reported, and does staff follow the written version?
  4. Can you produce the evidence that the control operated last month without asking anyone to reconstruct it?
  5. Have the people who perform the control been trained on it, and is that training recorded?
  6. Does anyone outside the unit test the control before the auditor does?
  7. Is there one tracker, visible to leadership, that shows every finding, its owner, its status, and its evidence?
  8. If the finding involves a system, has the system configuration changed, or only the people around it?
Who does what

We fix the control. Your leadership owns the response.

Every engagement letter states this division. Ulyx is not the auditor and does not perform attestation work, which is exactly why an audit firm can refer the remediation to us without an independence problem.

Ulyx Advisory delivers

  • Root-cause diagnosis for each finding, distinguishing design gaps from operating failures
  • Control redesign aligned to COSO and the GAO Green Book, sized to the unit that has to run it
  • Rewritten procedures, forms, and checklists in the words staff actually use
  • Role-based training, with attendance and competency records the auditor can see
  • A closeout tracker: finding, owner, control, evidence, test result, status
  • Pre-audit control testing and an evidence file organized the way OLA requests it
  • Draft language for the agency's written response and corrective-action plan

Your agency keeps

  • The official response to the auditor and all communication with OLA or the awarding agency
  • Management decisions on staffing, systems, and budget
  • Approval of every revised policy and procedure
  • Any legal determination; we provide non-legal consulting
  • The relationship with your external auditor or CPA firm, with whom we coordinate at your direction

Prime contractors and audit firms: see how we team on remediation scope →

Packages & pricing

Clear starting prices. A fixed quote before we start.

Each package is a fixed-price engagement with a written scope. All three fall within Maryland's small-procurement limit, so a state agency can engage us under simplified procedures, and our Certified Small Business and VSBE status applies to the award. Local governments and grant recipients are quoted on the same basis.

Start here

Finding Diagnostic

From$9,500 · 3–4 weeks

For an agency that wants to know why a finding keeps coming back before it commits to a fix.

  • Document review of the last two audit reports and your responses
  • Interviews with the control owners and the staff who perform the work
  • Root-cause memo for each finding in scope, design gap vs. operating failure
  • A sequenced remediation plan with owners, effort, and evidence requirements
  • A briefing for leadership and, if you want it, your auditor

Starting price covers up to four related findings in one agency or unit, about 45–55 hours. The Diagnostic fee is credited toward a Closeout engagement that starts within 60 days.

Program

Audit Readiness Program

From$78,000 · 22–26 weeks

For an agency with findings across several units, or one preparing for its next OLA cycle.

  • Closeout work across multiple units and finding types
  • An internal-control framework and self-assessment the agency keeps
  • A standing control-testing calendar and evidence file
  • Training for supervisors on running and documenting controls
  • Quarterly leadership reporting through the next audit

Starting price covers about 420–500 hours across up to three units. Larger agencies are quoted after the discovery call.

How engagements are set up

  • Scope, price, and the findings in scope are set in writing in the engagement letter before work starts.
  • Anything outside the agreed scope is quoted and approved in writing before we do it. No surprise invoices.
  • Prime contractors and audit firms can subcontract remediation scope to Ulyx; our Maryland VSBE and Montgomery County MFD status counts toward participation goals.

Founding-client terms: our first closeout clients receive reduced pricing in exchange for a reference and permission to describe the engagement. Ask about it on the discovery call.

Questions

Frequently asked

Are you auditors?

No. Ulyx Advisory does not perform audits or attestation engagements, and we do not opine on your financial statements or controls. We design and implement the fixes. That separation is what allows your external auditor, or the CPA firm that found the problem, to refer remediation work to us without compromising their independence.

Can a state agency engage you without a formal solicitation?

Each package on this page is priced within Maryland's small-procurement limit, which allows an agency to use simplified procurement procedures. Ulyx is a Maryland Certified Small Business and a certified VSBE, so the award also counts toward the agency's small-business and veteran-owned goals. Your procurement office makes the final determination on the method.

Will you work with our existing auditor or CPA firm?

Yes, at your direction. In most engagements we coordinate with the audit firm on what evidence they will expect, so the control we build is one they can test, and we stay out of their attestation work.

What if the finding is caused by a system we cannot change?

We separate what the system does from what people do around it. Many repeat findings are operating failures, not system limits, and can be closed with a compensating control, a procedure, and evidence. Where a system change is required, we specify it and your IT staff or vendor makes the change.

We are a county, a school system, or a grant recipient, not a state agency. Does this apply?

Yes. The same approach closes single-audit findings, county-auditor findings, and findings from a funder's monitoring visit. Pricing is on the same basis; the procurement method follows your own rules.

Is this legal advice?

No. Ulyx Advisory provides operational, non-legal governance and internal-control consulting. Any legal determination stays with your counsel, and the official response to the auditor is yours.

This page is general information about audit remediation for Maryland public-sector organizations, not legal advice. Audit statistics are drawn from published Office of Legislative Audits summaries and may change as new reports issue. Ulyx Advisory provides non-legal consulting and does not perform audit or attestation services.

Make the next report the one where it's closed.

A 30-minute discovery call is enough to tell whether a Diagnostic or a full Closeout fits, what your fixed price would be, and how to time the work against your next audit.

Schedule a Closeout Discovery Call