Interview Question for Staff Auditor at KPMG:

As a part of Audit: More often than not, most of the auditors face this problem that auditee does not resolve the exceptions raised by auditors the previous years. The best way to deal with these kind of problems was to increase the risk rating for not following the assurance.
If this problem were to relate to IT Services then I would say that a framework needs to be followed for resolving a recurring problem. Typically ITIL will do.