Follow-Up and Management Action Plans

The report isn’t the end

A report full of findings is worthless if nothing changes. Follow-up is how audit makes sure the agreed fixes actually happen. ITAF requires the auditor to monitor whether management has taken appropriate, timely action.

The split of jobs is simple: management fixes, audit checks. If the auditor did the fixing, they’d later be auditing their own work.

A good action plan

Each finding’s response should include:

• a specific action that deals with the root cause: “enable MFA for all remote access”, not “improve security”
• a named owner: a person, not a department
• a realistic date, with interim steps or temporary controls for long fixes

The follow-up process

1. Track every open finding in a register.
2. Schedule follow-up by seriousness. High-risk findings are followed up sooner, sometimes in a dedicated review; lower-risk ones may be checked at the next audit.
3. Verify: get evidence that the action is in place and working. For significant findings, an email saying “done” isn’t enough.
4. Close findings once verified, or escalate those that are overdue or ineffective.
5. Report the status of open findings to the audit committee regularly.

A different fix from the one the auditor recommended can be perfectly acceptable, as long as it deals with the risk.

Example. Management says leavers are now removed within one day. The auditor matches last month’s HR leavers list against active accounts and finds every one removed on time. Now the finding can be closed.

When management accepts the risk

Management may decide not to fix something, perhaps because the fix costs more than the risk it removes. That’s management’s decision to make, provided:

• it’s made by someone with the authority to accept the risk
• the remaining risk is within the organisation’s risk appetite
• it’s documented

If the auditor believes the accepted risk is beyond appetite, they raise it with senior management and, if it’s still unresolved, with the audit committee.

Example. A finding on missing MFA for remote access had a March deadline. In June it’s still open, and the owner has moved the date twice. Audit reports it as overdue to the audit committee, which asks the CIO to explain at its next meeting.

How the exam asks about it

In short

• Management owns the fixes. Audit monitors and verifies that agreed actions are actually done.
• A good action plan has a specific action, a named owner and a target date.
• Follow-up timing depends on how serious the finding is.
• The auditor checks the fix works, not just that management says it's done.
• Management may accept a risk instead of fixing it; if that risk is beyond appetite, it's escalated to senior management or the audit committee.
• The status of open findings is reported to the audit committee regularly.

Exam traps

• Audit doesn't implement the fix; that would impair its independence.
• 'It's done' from management isn't enough evidence for a significant finding; verify it.
• Repeatedly missed deadlines get escalated, not quietly re-dated.
• A different fix from the one recommended can be fine, if it deals with the risk.

Slides

Click the slide and use the arrow keys. F toggles full screen.