A recommendation in a BPK audit report is more than an administrative task. It is an examiner's proposal for an authorised person or body to take action or make improvements. The official examined or otherwise responsible must follow it up, and BPK monitors that process. This framework appears in Law No. 15 of 2004 and is set out in more operational detail in BPK Regulation No. 2 of 2017.
Effective follow-up requires an appropriate action, evidence that can be examined, and BPK's assessment of whether the action meets the recommendation. Sending a response does not, by itself, close the matter. Equally, an entity cannot unilaterally declare a recommendation impossible to implement or its administrative obligation complete.
Begin with the recommendation and the responsible official
The first step is to read the finding, recommendation, and addressee in the audit report. An action plan should address the identified problem rather than merely produce a new document. If a recommendation seeks stronger controls, for example, issuing a procedure may be a starting point; records showing that the procedure is actually used may also be necessary. This is an illustration, not a universal test: the specific recommendation governs the assessment.
Management should make responsibility for each recommendation clear. As an internal management practice, a register can record the audit report reference, proposed action, responsible official, supporting evidence, and progress. Assigning operational tasks does not transfer the statutory obligation of the official responsible under the applicable rules. Coordination with finance, operations, legal staff, or internal oversight should be documented where relevant.
The response deadline and supporting evidence
Under Article 3 of BPK Regulation No. 2 of 2017, the follow-up takes the form of a response or explanation of the action taken, accompanied by supporting documents. It must reach BPK no later than 60 days after the audit report is received. The regulation defines “days” as calendar days. Receipt of the report, rather than its publication or an internal meeting, therefore starts the clock; the receipt record matters.
Article 4 requires the response and supporting documents to be sufficient, competent, and relevant, and verified by the internal oversight apparatus. Submission is evidenced by a receipt. “Sufficient” evidence can persuade a reader that the recommendation has been implemented; “competent” evidence is valid and reliable; and “relevant” evidence has a meaningful logical connection to the recommendation. The number of attachments is not the test. Reconciliations, implementation records, repayment documents, or oversight results are useful only where they support the action actually required.
If implementation cannot be completed within the deadline, Article 5 requires the official to provide a legally valid reason. The regulation sets out limited grounds, including force majeure and other reasons recognised by law; ordinary operational difficulty does not automatically qualify. A valid reason does not release the official from the duty to follow up. An internally agreed “realistic” target must therefore not be mistaken for a replacement of the legal deadline.
Who determines the follow-up status?
BPK reviews the official's response to decide whether action accords with its recommendation. Articles 6 and 7 provide four classifications: follow-up in accordance with the recommendation; follow-up not yet in accordance; recommendation not yet followed up; or recommendation that cannot be followed up. “Not yet in accordance” includes an action still in progress. The last category is based on BPK's professional judgement, not simply on an entity's preference.
Under Article 8, the “in accordance” and “cannot be followed up” classifications require approval from a BPK member or an authorised BPK officer. The official's administrative responsibility to follow up is treated as complete in either of those classifications. An internal label such as “completed,” “response sent,” or “in progress” is therefore not the same as BPK's assessed status.
If BPK classifies a recommendation as not yet in accordance or not yet followed up, Article 9 requires the official to act within 30 days after the entity receives the status determination. That is a separate deadline from the initial 60 days after receipt of the audit report. An internal register should distinguish the two events and record the relevant evidence of receipt.
Administrative follow-up and criminal proceedings are distinct
Correcting an administrative weakness, recovering money or assets, and addressing a suspected criminal offence may involve different authorities. Article 10 of the BPK regulation explicitly provides that completing follow-up does not extinguish criminal prosecution. A status of “in accordance” is not a determination that an offence did or did not occur, nor a finding of an individual's guilt.
Conversely, an audit finding should not automatically be described as a criminal conviction. Suspected offences follow their own legal rules, competent authorities, and evidentiary process. An entity should continue corrective action within its authority, preserve the relevant records, and coordinate with the competent institutions when required. Public statements about named individuals or specific events must not go beyond the established facts and lawful process.
Monitoring within the entity
An internal recommendation register should be updated against actual evidence and BPK's review, not oral assurances alone. Where evidence is incomplete, record the gap, responsible person, and next action. Where there is an impediment, document it and assess whether it meets the regulation's narrow test for a valid reason. Longer-term systemic improvement can continue to be monitored, but it does not excuse failure to send the required response to BPK.
BPK summarises follow-up monitoring in its Semester Audit Results Summary (IHPS). That public summary helps readers understand broad patterns, but it does not replace the audit report, recommendation, response, and BPK review that apply to a particular entity.
Conclusion
Following up on BPK recommendations is a duty with a defined deadline, evidence requirements, and an assessment process. The responsible official should connect each action to the recommendation in the audit report, submit a verified response and supporting records, and monitor BPK's classification until the administrative obligation is resolved. Administrative completion must remain separate from other possible legal consequences.
Official references
Law No. 15 of 2004; Law No. 15 of 2006; BPK Regulation No. 2 of 2017; and BPK IHPS.
Disclaimer. This article is general information, not legal, audit, investigation, or professional advice for a specific situation. The facts, powers, and applicable rules must be considered in each case.