Communicating Results and Monitoring Progress
The final report and the follow-up process are where good fieldwork earns or loses credit. Questions test required content, quality criteria, distribution, and what happens when management accepts the risk instead of acting.
Communicating
- Standard 2410: communications must include objectives, scope, results including findings, conclusions, and recommendations, and management's responses and action plans.
- Standard 2420: communications must be accurate, objective, clear, concise, constructive, complete, and timely.
- When management disagrees with a finding, the report states both positions and the reasons; omitting management's response distorts the record.
- Standard 2430 permits stating that the engagement was 'conducted in conformance with the Standards' only when QAIP results support that conclusion.
- Standard 2440: the CAE controls distribution; the report goes to those who can act, and to the board for significant matters.
- Interim reporting is appropriate for critical issues before the report is final.
- If a final report contains a material error, the corrected report is issued to everyone who received the original (Standard 2421).
Monitoring
- Standard 2500: the CAE must establish and maintain a follow-up process to monitor and confirm that action has been taken or that senior management has accepted the risk of not acting.
- Standard 2500.A1: unresolved issues, including accepted risks, are escalated to senior management and, when the matter is significant, to the board.
- A rating scale must be defined and applied consistently; an adverse rating needs to be supported by the individual findings.
Worked example
An audit reports an unreconciled suspense account of $2 million. Management responds that it will not correct the balance because the effort outweighs the risk, and asks that the finding be closed. Internal audit may close its follow-up only if senior management formally accepts the risk and it is recorded; because the amount is significant, the acceptance is reported to the audit committee. 'Remediation waived' without documented acceptance is not closure.
Traps that cost marks
- Sending the report only to the manager of the audited activity.
- Dropping management's response or disagreement from the final report.
- Declaring conformance with the Standards when the QAIP found nonconformance.
- Closing findings on management's verbal assurance without verification.