![]() ![]() Will it be the process owner or management, will internal audit conduct targeted follow-up, or will an additional audit be required to determine the recommendations have been addressed? Different follow-up methods can and should be used depending on the scope of the initial audit area and the severity of findings identified. There are also various types of follow-up procedures that need to be determined, including who is responsible for the follow-up that needs to occur. Internal audit should assess and document management’s reasoning for requesting an extension to ensure it is legitimate. ![]() It is also critical to document any management requests for extensions to initial time frames for resolution. This is especially important for recommendations that cannot reasonably be implemented immediately, such as those requiring capital costs or significant process enhancements. ![]() In some instances, follow-up and resolution of audit findings could also be required prior to internal audit issuing final reports.Ī findings tracking system should also provide an opportunity to document and track management’s responses to findings and follow-up communication that has occurred. In determining appropriate follow-up and monitoring, internal audit should work with management to determine an appropriate time frame - monthly, quarterly, annually or just prior to the next audit of that area. More severe findings should be followed up on more frequently. Tracking systems should assist auditors in determining when follow-up should occur, which often depends on the severity of the finding and management’s proposed time frame for resolving the recommendation. However, even manual tracking systems, such as Excel spreadsheets and calendar reminders, can provide the same level of tracking at a more reasonable cost. Establishing a tracking systemĪ critical process in resolving internal audit findings is establishing a findings tracking system.Īn automated tracking system can be beneficial in ensuring timely follow-up occurs and is often built into most modern audit and work paper software programs. Creating partnerships with management to work through recommendations and the actions required to resolve findings is paramount to management seeing value in those recommendations. This may lead to mistrust toward the internal auditor. If your management is unaware of what internal audit expects, it will be more difficult for management to meet any expectation and can result in miscommunications and re-work. It’s important that your management be aware of and agree with what internal audit needs in order to conduct monitoring and verify the achievement of the recommendations so management actions will be accepted by internal audit. You must consider who will be responsible for monitoring and follow-up, what needs to be monitored, how often monitoring will occur, and finally the type of monitoring required. Planning is crucial to success in monitoring outcomes of engagement recommendations. Seeing value in internal audit recommendations Their responses to internal audit findings should be precise, address the root cause, and include responsible individuals and timelines for implementation.Īdditionally, internal audit procedures related to management’s responses should include expectations for timing of the receipt of management responses, evaluation, verification and follow-up of the responses, as well as a process for internal audit to escalate unacceptable responses. There should be adequate procedures and controls in place to monitor and validate that your management commits to and acts on internal audit recommendations. However, the internal auditor is the one who determines whether the desired outcome was achieved and your management’s actions were enough to resolve the finding. No real improvements occur as a result of recommendations, so internal audit comes off as not adding value to the organization.įrom an internal audit perspective, it’s your management’s responsibility to ensure internal audit findings are adequately resolved. If findings are not addressed and appropriately resolved by management, and there is inadequate follow-up, the internal audit activity could be perceived as irrelevant. Why it’s so important to resolve findings Monitoring the resolution of internal audit findings and recommendations should be included in your organization’s internal audit plan, and it should be thought of as a significant control step in any internal audit activity. The Institute of Internal Auditors (IIA) standards state, “The chief audit executive must establish and maintain a system to monitor the disposition of results communicated to management.” Do you have a system that monitors how internal audit findings are resolved? ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |