Closing the Loop: Why Internal Audit Follow-up Matters

Background

In the foreword to the revised Global Internal Audit Standards (GIAS), the Institute of Internal Auditors (IIA) describes internal auditing as playing a critical role in enhancing an organization’s ability to serve the public interest:

“While the primary function of internal auditing is to strengthen governance, risk management, and control processes, its effects extend beyond the organization. Internal auditing contributes to an organization’s overall stability and sustainability by providing assurance on its operational efficiency, reliability of reporting, compliance with laws and/or regulations, safeguarding of assets, and ethical culture. This, in turn, fosters public trust and confidence in the organization and the broader systems of which it is a part.”

This article examines an often-overlooked part of the internal audit process: follow-up of audit issues and management action plans. Effective follow-up helps ensure that audit findings lead to meaningful changes—not simply recommendations recorded in a report. It therefore contributes to the effectiveness of individual audits, the internal audit function and, ultimately, the organization’s operations.

The role of internal audit

The IIA describes internal auditing as an independent, objective activity that helps organizations improve their operations. By evaluating governance, risk management and control processes, internal auditors help organizations achieve their objectives, protect value and build trust.

Internal auditors also look beyond the numbers. They examine how work is carried out and provide insight to help leaders improve operations and achieve objectives. Although internal auditors have traditionally been viewed as faultfinders or watchdogs, that perception is evolving. In a changing risk environment, internal audit can be a valuable partner in helping organizations respond to current and emerging challenges—while maintaining the independence and objectivity essential to its role.

The phases of internal audit

The performance of internal audit services is addressed in Domain V of the GIAS, Performing Internal Audit Services. It covers three connected principles: planning engagements, conducting engagement work, and communicating results and monitoring action plans.

Engagement planning

Principle 13, Plan Engagements Effectively, requires internal auditors to plan each engagement using a systematic, disciplined approach. The Standards and the methodologies established by the chief audit executive (CAE) provide the foundation for that approach.

Planning begins with understanding the engagement’s purpose, initial expectations and reason for inclusion in the internal audit plan. Auditors gather information about the organization and the activity under review and assess the relevant risks. Planning also involves:

• Defining the engagement’s objectives and scope.

• Identifying the criteria against which the activity will be evaluated.

• Assessing whether internal audit has appropriate and sufficient resources.

• Developing the audit work programme.

Conducting engagement work

Principle 14, Conduct Engagement Work, requires internal auditors to implement the engagement work programme to achieve the engagement objectiveAuditors gather information, conduct analyses and evaluations, and develop evidence. This work enables them to:

• Provide assurance and identify potential findings.

• Determine the causes, effects and significance of findings.

• Develop recommendations or work with management to develop action plans.

• Form conclusions.

  
  

Engagement reporting

Principle 15, Communicate Engagement Results and Monitor Action Plans, covers both communicating engagement results and monitoring management’s progress in implementing recommendations or action plans. For each engagement, internal auditors must prepare a final communication that includes the engagement’s objectives, scope and conclusions, as well as recommendations or action plans where applicable. For assurance engagements, the final communication must also include:

• Findings, including their significance and prioritization.

• Any limitations on the engagement’s scope.

• A conclusion on the effectiveness of the governance, risk management and control processes in the activity reviewed.

  
  

Monitoring action plans

Follow-up is an essential part of the audit cycle. Under the GIAS, Standard 15.1 addresses the final engagement communication, while Standard 15.2 addresses confirming the implementation of recommendations or management action plans. The IIA’s Standards identify monitoring action plans as part of the internal audit function’s responsibilities.

Management owns and implements corrective actions to the findings identified by the internal audit function. Internal audit’s role is to monitor progress and confirm whether agreed actions have been implemented. Follow-up should be proportionate to the risk, and actions reported as closed should be validated. Results—including recommendations that remain unimplemented—should be reported to senior management and the board.

Without a clear follow-up process and sufficient attention to remediation, findings may remain unresolved, leaving the organization exposed to the risks identified in the audit. Weak follow-up can also undermine confidence in the internal audit function, diminish the value of completed audits and raise questions about the organization’s ability to address weaknesses in its risk management and control processes.

Why follow-up activities may be deprioritized

Follow-up may receive less attention once the fieldwork is complete and the final report has been issued. The audit can appear “finished”, even though management’s response to the findings—and the organization’s progress in addressing them—may still be under way.

Resource constraints can contribute to the problem. When planned audits exceed their allocated time or budget, follow-up work may be reduced or deferred to compensate for the reduction in budgeted hours. Yet without adequate follow-up, internal audit may not be able to establish whether management actions have addressed the underlying issues.

The CAE should therefore account for follow-up activities when planning the internal audit function’s work and allocating resources. Follow-up should also be risk-based: higher-risk findings generally warrant more timely and direct validation than lower-risk items. Depending on the internal audit methodology and the issue’s significance, lower-risk actions may be followed up through management updates and supporting documentation, while higher-risk actions may require more extensive testing.

Conclusion

Every phase of an audit matters, but follow-up is where the organization’s response to the audit is tested. It helps establish whether agreed actions have been implemented and whether management has addressed the risks identified. Giving the follow-up activity appropriate resources, attention and risk-based oversight helps turn audit findings into lasting improvements—supporting stronger operations, organizational resilience and the achievement of objectives.