Audit results and monitoring: from final report to verified action
An audit is not finished merely because the report is issued. Communicate supported conclusions and agreed actions, then monitor whether management implements them and addresses the risk. Management owns remediation; internal audit follows up and communicates significant delays or unacceptable risk acceptance.
Keep the reporting and follow-up responsibilities distinct
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Final communication | Explain objectives, scope, results, and relevant limitations clearly. | Presenting incomplete coverage as full assurance. |
| Action ownership | Identify responsible management and the agreed response and timing. | Making internal audit the owner of the operating fix. |
| Follow-up | Obtain appropriate evidence, reassess exposure, and communicate unresolved concerns. | Closing an issue solely because its due date has arrived. |
Final communication
Explain objectives, scope, results, and relevant limitations clearly.
Avoid: Presenting incomplete coverage as full assurance.
Action ownership
Identify responsible management and the agreed response and timing.
Avoid: Making internal audit the owner of the operating fix.
Follow-up
Obtain appropriate evidence, reassess exposure, and communicate unresolved concerns.
Avoid: Closing an issue solely because its due date has arrived.
A decision path you can use
- 1Communicate the supported result
- 2Track management’s response
- 3Verify implementation and escalate concerns
Understand the method
Work through the reasoning
Establish a clear starting point for follow-up
The final communication should make the objective, scope, significant results, and relevant limitations understandable. Recommendations or agreed actions need enough specificity to be monitored. Identify responsible management and expected timing as applicable, and preserve the finding’s connection to the underlying risk.
An action such as “improve access controls” is difficult to evaluate later. A clearer response identifies the gap to be addressed and the intended outcome, while management retains responsibility for the implementation method. Good follow-up begins with a report that establishes what needs to change.
Monitor management’s implementation
Internal audit should have a methodology for confirming implementation of recommendations or action plans. The nature of follow-up should reflect the significance of the finding and the circumstances. Obtain progress information, evaluate supporting evidence, and perform appropriate further work rather than automatically accepting a completed status.
Keep the roles distinct. Management implements and operates the response. Audit evaluates and communicates. If audit takes over the control to ensure completion, it creates an accountability and objectivity problem for later assurance.
Distinguish action delivery from risk treatment
A new policy, training session, or system change may be a necessary step without demonstrating that the original weakness is addressed. Consider whether the design now responds to the cause and whether evidence shows implementation. Higher-risk findings may require more extensive confirmation than a document inspection.
If management chooses an alternative response, evaluate whether it addresses the risk rather than insisting mechanically on the original recommendation. Record the basis for closure or continued monitoring. The purpose is appropriate risk treatment, not compliance with an auditor’s preferred wording.
Address delay and risk acceptance appropriately
Delayed action may leave significant exposure. Understand the reason, current conditions, interim measures, and management’s decision. A revised deadline is a scheduling fact, not proof that the remaining risk is acceptable. Communicate significant unresolved matters through the established route.
When the chief audit executive concludes that management has accepted risk beyond the organization’s appetite or tolerance, the matter is discussed with senior management and escalated to the board if unresolved. Internal audit communicates the concern; it does not become responsible for resolving management’s risk itself.
Original teaching example
Apply the method to a decision
The scenario
A report calls for independent approval of vendor bank changes. Management marks the action complete after publishing a policy, but system access still allows one person to create and release changes.
The decision
Do not treat policy publication alone as evidence that the control weakness has been corrected.
Assess the implemented workflow and relevant transactions. The response must address the cause of the finding. If management chooses to retain the exposure, evaluate and communicate that risk acceptance through the appropriate process.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
A different action addresses the same weakness
The situation
The report recommended a manual second approval. Management implements a system-enforced separation of requester and approver instead and supplies configuration and transaction evidence.
Reason through it
The alternative may address the original authorization risk more effectively. Audit should evaluate the design and implementation against the finding rather than reject it because the mechanism differs from the recommendation.
Take the decision
Confirm whether the response addresses the risk, document the evidence, and make a supported closure decision.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Should an issue already fixed during fieldwork disappear from the final communication?
Evaluate its significance and communicate the condition and remediation appropriately. Timely correction can change the current exposure, but it does not justify hiding a significant finding or overstating the work performed.
Must management implement the exact action suggested by audit?
Not necessarily. Management may choose another response that adequately addresses the finding. Internal audit should evaluate the alternative and its implementation evidence, with appropriate communication where disagreement or unacceptable risk remains.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Engagement Results and Monitoring (45% of Part 3). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standards 11.2-11.5 and 15.1-15.2. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 3: Internal Audit Function. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.