Two audit teams find the same broken vendor-approval control. One writes a three-page recommendation nobody asked for. The other gets a dated, named, root-cause-fixing commitment from the process owner in the closing meeting. Same finding, different value, and the exam tests which path you should have chosen.
A finding without a fix is an observation. The engagement's job is to convert the finding into a corrective commitment. You have three delivery modes, and they are not interchangeable.
- Recommendation: internal audit's suggested corrective action. Internal audit proposes; management may accept, modify, or reject.
- Management action plan (MAP): management's own written commitment to correct the condition, with an owner and a due date. Internal audit requests it and evaluates its adequacy.
- Agreed action: a fix developed jointly during the engagement, typically negotiated in the closing meeting.
KEY: Only the action plan and the agreed action create accountability that internal audit can later verify in follow-up. A recommendation management never accepted has no owner and no date, so there is nothing to monitor.
Common mistakes
- Deleting a finding to end a dispute. If evidence supports the condition, it stays in the report with management's position stated alongside. Removal is only appropriate when re-examination shows the finding is wrong.
- Accepting "management will enhance monitoring" as a plan. No owner, no date, no testable deliverable. Send it back for specificity.
- Treating effects and calling it root cause. Correcting the 9 bypassed purchase orders leaves the approval configuration untouched, so the next 9 happen the same way.
Bottom line
- Three modes: recommendation (internal audit proposes), action plan (management commits, default choice), agreed action (developed jointly during the engagement).
- Only committed plans and agreed actions carry an owner and a date, so only those are verifiable in follow-up.
- Purpose of every mode is to treat the cause and close the gap between condition and criteria, not to fill report space.
- Cost-benefit screen: net benefit equals reduction in expected loss minus annual control cost, where expected loss is exposure times probability.
Exam shortcut
Read the stem for who designs the fix. Management capable and willing means request an action plan. Technical or urgent means collaborate on an agreed action. Unwilling or unable means recommendation plus escalation. If a stem gives an expected loss and a control cost, compute both sides before reading options.
The full lesson (about 2,350 words, 16 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 3
Browse all free CIA Part 3 lessons or jump into free CIA Part 3 practice questions.