Engagement Monitoring
Monitoring closes the loop
Monitoring progress confirms that management's actions on reported findings are actually implemented and effective. It is not a full re-audit; it is risk-based verification that the agreed action occurred and addressed the condition. Good practice defines, for each accepted recommendation: an owner, a due date, the evidence that will demonstrate completion, and a risk rating that sets follow-up priority. High-risk findings are followed up sooner and more thoroughly; lower-risk ones may be tracked through management's own reporting. The internal auditor verifies implementation with evidence - a system screenshot, a revised policy, a test of the new control - rather than management's assurance alone, and escalates unresolved or overdue high-risk issues to senior management and the board.
Distinguish three things routinely confused on exams: supervision (review of work during the engagement), follow-up/monitoring of engagement outcomes (verification of corrective action after reporting), and the quality assurance and improvement program (periodic evaluation of the internal audit activity itself).
Traps that show up in questions
- Closing an issue because management says it will act.
- Closing on a partial fix that leaves the root cause in place.
- Re-performing the entire original engagement instead of targeted verification.
- Using one fixed follow-up window regardless of risk.
- Failing to report non-implementation upward.
Rule of thumb: for every recommendation ask what evidence would show it is fixed, then go obtain that evidence.
Worked example: a finding required segregation of duties in payroll. Management reports it is implemented. The auditor inspects the system role matrix and tests one payroll run, confirming the preparer can no longer approve payments, then closes the issue.