A high-rated finding on privileged access was agreed by the process owner in March with a June 30 remediation date. It is now October. The follow-up test shows nothing was done, and the process owner says the project was deprioritized. Escalation is the disciplined path from that moment to a resolved risk, and the exam tests both who gets involved and in what order.
Escalation is not a mood. It is triggered by evidence from follow-up testing. Follow-up is the process by which internal audit confirms whether management implemented the agreed action plan and whether the implementation actually reduced the risk. Only three outcomes exist: implemented and effective, implemented but ineffective, or not implemented.
KEY: Escalation begins when a verified deficiency persists past the agreed date, or when management explicitly declines to act. A missed interim milestone with a credible revised plan is monitored, not escalated.
Three distinct situations feed the escalation path, and the exam separates them:
- Nonimplementation: the action plan is past due with no substantive progress.
- Inadequate implementation: something was built, but retesting shows the underlying risk remains.
Common mistakes
- Escalating on a status report instead of tested evidence. An owner's assertion that remediation is "90% done" is not verification. Retest, then escalate on the result.
- Jumping straight to the board. Skipping the process owner and senior management damages the relationship and produces a board item management has never seen. The 94-day item still goes to the owner first.
- Treating a revised date as an automatic escalation. One credible date change on a low-rated item is monitoring. A pattern of repeated slippage without progress is escalation.
Bottom line
- Trigger: escalation starts from verified follow-up evidence that an action plan is past due, ineffective on retest, or explicitly declined.
- Three outcomes: implemented and effective, implemented but ineffective (still open), or not implemented.
- Parties in order: process owner, next level of management, chief audit executive, senior management, board or audit committee.
- Auditor limit: engagement auditors escalate to the CAE; only the CAE communicates unresolved matters to the board.
Exam shortcut
Read the stem for the rung the actor occupies, then move exactly one rung. If the actor is a staff or senior auditor, the correct next action is almost never "notify the board"; it is confirm with the process owner or report to the CAE. Eliminate any option where a non-CAE auditor contacts the audit committee.
The full lesson (about 2,234 words, 15 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 8
Browse all free CIA Part 3 lessons or jump into free CIA Part 3 practice questions.