There is no question that the follow-up process is intended to correct that.
My experience is from the provincial sector, and Lesley's certainly senior practice is more broad.
When a report comes back to the committee for follow-up, I have seen far too many times the ministry saying, “Yes, we've got it” or, “Yes, they're implemented”, and it's critical to dive into, “Well, show me.” It's the “trust but verify” example. You need to have a good working relationship with them, but it doesn't mean you don't have to see the evidence: “Can you show us what you've done?”; “Explain exactly what you've done”; “How can you be sure that it is something that is going to fix this problem?”
While the audit office may not have done a follow-up audit on it, I've certainly had the question thrown at me, “Well, Madam Auditor, if that's what they've done, is that going to resolve the problem?” Certainly the audit office can speak to whether or not what they're hearing is consistent with what they were looking for. It really is in that follow-up process.
The time challenge is that if you redid every audit, you'd never get anything new done, so they can't put all their time into doing this. At the same time, you can narrow it down to key risk areas, focus on the big problem areas, and then really dive into whether or not it's been remedied.