I have to agree...follow through now that we spent $200k is important.  I don't have a lot of confidence.  Too easy to slip back into old habits with turnover of board and management. And as you said the forensic audit really only focused on two departments, three if you count the investigation of finance employees.  I will also say this that not all organizations really give the internal audit function the authority it requires to be a change agent. I have also experienced a culture where the internal controls can be almost overbearing.   Can be a tough balancing act...not unlike HR.