Reducing repeat findings and control failures in operationally intensive U.S. enterprises: A data-driven internal audit framework for remediation, loss prevention, and governance improvement

Operationally intensive enterprises are especially vulnerable to repeat audit findings because they combine high transaction volumes, distributed assets, complex workflows, decentralized execution, and uneven managerial follow-through. This study develops a data-driven internal audit framework for reducing recurring control failures, preventing avoidable loss, and strengthening governance in such settings. The paper combines a structured review of internal-audit, remediation, fraud, and audit-analytics literature with descriptive analysis of the public Audit Data corpus originally documented by the UCI Machine Learning Repository and widely mirrored on Kaggle. The dataset contains 777 observations across 14 sectors and was designed to support the prediction of suspicious firms using present and historical risk factors. Descriptive analysis of the documented sector counts shows that the three largest sectors account for 52.6% of observations and the top five account for 73.1%, indicating material concentration of auditable exposure. The concentration profile (HHI = 1,406.0; Gini = 0.521) suggests that repeat findings are likely to cluster in large, operationally dense environments while smaller sectors remain susceptible to under-audited tail risk. Based on those patterns and the broader literature, the study proposes a five-stage framework that integrates risk-based planning, root-cause analysis, remediation ownership, analytics-supported exception monitoring, and board-level action tracking. The core argument is that organizations do not reduce repeat findings simply by issuing more audit reports; they reduce them by shortening detection lag, assigning accountable owners, validating corrective action, and continuously measuring whether the same failure mode reappears. The paper contributes a practical governance model for U.S. enterprises seeking to move internal audit from retrospective reporting to a closed-loop assurance and remediation system.