Practice Advisory 2500.

A1-1: Follow-up Process

Interpretation of Standard 2500 from the International Standards for the Professional Practice of Internal Auditing

Related Standard 2500.A1 The chief audit executive should establish a follow-up process to monitor and ensure that management actions have been effectively implemented or that senior management has accepted the risk of not taking action.

Nature of this Practice Advisory: Internal auditors should consider the following suggestions when establishing follow-up processes. This guidance is not intended to represent all the considerations that may be necessary during such an evaluation, but simply a recommended set of items that should be addressed. 1. Internal auditors should determine that corrective action was taken and is achieving the desired results, or that senior management or the board has assumed the risk of not taking corrective action on reported observations. 2. Follow-up by internal auditors is defined as a process by which they determine the adequacy, effectiveness, and timeliness of actions taken by management on reported engagement observations and recommendations, including those made by external auditors and others. 3. Responsibility for follow-up should be defined in the internal audit activity s written charter. The nature, timing, and extent of follow-up should be determined by the chief audit executive (CAE). Factors that should be considered in determining appropriate follow-up procedures are: The significance of the reported observation or recommendation. The degree of effort and cost needed to correct the reported condition. The impact that may result should the corrective action fail. The complexity of the corrective action. The time period involved. 4. There may also be instances where the CAE judges that management s oral or written response shows that action already taken is sufficient when weighed against the relative importance of the engagement observation or recommendation. On such occasions, followup may be performed as part of the next engagement. 5. Internal auditors should ascertain that actions taken on engagement observations and recommendations remedy the underlying conditions.

6. The CAE is responsible for scheduling follow-up activities as part of developing engagement work schedules. Scheduling of follow-up should be based on the risk and exposure involved, as well as the degree of difficulty and the significance of timing in implementing corrective action.
Origination date: Jan 5, 2001 All contents of this Web site, except where expressly stated, are the copyrighted property of The Institute of Internal Auditors, Inc. (The IIA). Privacy Policy