Audits Are Only as Good as Their Follow-up — A Guide to Effective Issue Tracking
The Follow-up Standard
Standard 15.2 requires internal audit functions to confirm whether management has implemented action plans and, when they have not, to follow the CAE's established guidelines for management acceptance of risk .
The Follow-up Challenge
Follow-up processes are often less structured than planning or testing phases. Many offices rely heavily on email and phone communication and lack standardized tools for tracking status updates .
Common problems:
- Auditors feel the follow-up process is treated like an afterthought
- Delays in management action plan completion
- Clients do not provide explanations or updated timelines
- Balancing accountability with maintaining positive client relationships
- Determining what constitutes sufficient verification
Strategies for Effective Follow-up
1. Evidence-Based Approach
Transition from "trust but don't verify" cultures to more evidence-based follow-up procedures .
2. Include Follow-up in the Audit Plan
Include follow-up activities directly in the audit plan to signal their importance to leadership and audit committees .
3. Use Standard Templates
Develop standard templates for documenting action plan status updates .
4. Establish Regular Cadences
Establish regular follow-up cadences, such as every 90-120 days .
5. Conduct Interim Check-Ins
Conduct interim check-ins rather than waiting for due dates, which has improved implementation rates .
6. Prioritize High-Risk Findings
Use prioritization methodologies to identify high-risk findings that require closer monitoring or escalation .
7. Require Written Justifications
Require written justifications for non-implementation or use standard forms for documenting risk acceptance .
8. Use Dashboards
Report overdue action plans to leadership using dashboards and visualizations .
9. Escalate to Leadership
Require clients to present their rationale for non-implementation directly to the audit committee .
Determining Verification Sufficiency
Determining what constitutes sufficient verification—especially when deciding between retesting and reviewing client-provided evidence—remains a challenge .
Guidelines:
- Low-risk findings: Client-provided evidence may suffice
- High-risk findings: Independent verification (retesting) may be warranted
- Document the rationale for verification approach
Action Plan Development
During reporting, auditors should :
- Have the client determine the specific action plan (with internal audit approval) to mitigate each finding rather than prescribing action plans they may not fully understand
- Define what "implemented" will look like for each action plan
- Explain how non-responsiveness may be escalated
Conclusion
Follow-up is essential for audit effectiveness. Organizations that implement structured follow-up processes will achieve better action plan implementation and stronger control environments.
Action Items for Your Organization
- Document your follow-up methodology
- Create standard templates for status updates
- Establish regular follow-up cadences
- Develop escalation procedures
- Report follow-up status to leadership
- Verify action plan implementation
