A report gets issued, management agrees to fix three control gaps by the end of the quarter, and everyone moves on. Eleven months later the same gaps appear in a regulatory exam. The engagement was not the failure. The follow-up was.
An engagement's value is not the report. It is the change the report causes. Follow-up is the process by which the internal audit function tracks whether management actually did what it said it would do, and whether the action taken actually fixed the underlying condition. Without it, the function issues opinions into a void.
A management action plan (MAP) is management's documented response to a finding: what will be done, by whom, and by when. It is management's plan, not internal audit's. Internal audit recommends; management decides, resources, and executes. The internal audit function's responsibility for follow-up begins after that.
KEY: The chief audit executive (CAE) is responsible for establishing and maintaining a process to monitor the disposition of results communicated to management. Management is responsible for implementing. Those two responsibilities never merge.
Common mistakes
- Accepting management's word as closure evidence. An owner emailing "done" is an assertion, not evidence. For high-rated findings, retest; for others, inspect a named artifact.
- Closing on implementation date rather than operating evidence. A control live on 1 June tested against May transactions proves nothing. Retest a post-implementation period.
- Letting internal audit write or own the action plan. The function recommends and confirms. Drafting management's plan and then verifying it creates self-review, and the plan loses its accountable owner.
Bottom line
- CAE duty: establish and maintain a follow-up process, monitor disposition of results, confirm implementation with evidence, and escalate accepted risk.
- Management owns the action plan, the resources, and the execution; internal audit recommends, verifies, and approves closure.
- Confirmable action plans carry five elements: specific action, named accountable owner, due date, named evidence artifact, and interim residual risk.
- Step order: record at issuance, schedule by risk rating, request status, obtain and evaluate evidence, retest where warranted, reach disposition, report and escalate.
Exam shortcut
When a stem says management "confirmed" or "advised" that remediation is complete, the answer is almost always to obtain evidence or retest, never to close. Eliminate any option containing "rely on management's representation." When a stem contains "accepts the risk," run the two-step ladder in order: senior management discussion first, board communication second.
The full lesson (about 2,298 words, 15 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 7
Browse all free CIA Part 3 lessons or jump into free CIA Part 3 practice questions.