Internal Audit Follow-Up: Confirming Action Plans Under Standard 15.2

A finding that nobody follows up on is a finding that gets repeated. Standard 15.2 of the IIA Global Internal Audit Standards turns follow-up into a requirement with three parts and an escalation path. This post explains each and shows a tracker that satisfies the standard.

What Standard 15.2 requires

Internal auditors must confirm that management has implemented the auditors' recommendations or management's action plans, following an established methodology that includes:

1. Inquiring about progress on the implementation.
2. Performing follow-up assessments using a risk-based approach.
3. Updating the status of management's actions in a tracking system.

The extent of procedures must consider the significance of the finding. If management has not progressed according to the established completion dates, internal auditors must obtain and document an explanation from management and discuss the issue with the chief audit executive. The chief audit executive is responsible for determining whether senior management, by delay or inaction, has accepted a risk that exceeds the risk tolerance. That determination connects to Standard 11.5, covered in /us/blog/communicating-risk-acceptance-to-the-board-standard-11-5.

What risk-based follow-up looks like

The standard ties the depth of follow-up to significance. One reasonable method (the standard prescribes depth by significance, not these specific tests or timings):

The distinction between inquiry and testing matters. Inquiry alone is the weakest evidence. A high finding on duplicate payments is not closed because the supervisor says the system was reconfigured. It is closed when internal audit has run the full-population match again over a period after the change and the exception rate is zero or explained.

The tracker

A tracking system needs these fields at minimum: finding ID, engagement, rating, owner, original due date, revised due dates with approver, status, evidence reviewed, date internal audit validated closure, and the validator. Keep the original date visible. Overwriting it hides slippage, and because the standard makes the chief audit executive responsible for judging whether "delay or inaction" has amounted to risk acceptance, slippage has to stay visible.

Example rows:

The third row is the one the standard addresses. A medium finding that misses even its extended date triggers the documented explanation from management and a discussion with the chief audit executive.

When management does not act

When the chief audit executive concludes that management has accepted a level of risk above the organization's risk appetite or tolerance, Standard 11.5 requires the matter to be discussed with senior management and, if unresolved, escalated to the board. The standard adds that it is not the chief audit executive's responsibility to resolve the risk. That sentence protects independence: internal audit reports, and management and the board decide.

A practical escalation sequence:

1. Item passes its due date: owner provides a written explanation within a set number of business days.
2. Second miss, or a high-rated item overdue: chief audit executive meets the executive sponsor.
3. No agreed path: the item goes on the audit committee agenda as an accepted risk, with the exposure estimate from the original finding.

Reporting follow-up results

Standard 8.1 lists results of internal audit services, including monitoring results, among the items the chief audit executive reports to the board and senior management. A one-page dashboard works: open findings by rating, number past due, average age of high findings, items closed and validated this period, and the list of accepted risks. Standard 11.3 also says themes, such as root causes that recur across engagements, must be communicated timely. Follow-up data is where themes show up first. If four of six overdue items involve the same business unit or the same system, that is a theme to raise.

Setting realistic due dates

Follow-up quality starts when the action plan is written. Standard 14.4 requires internal auditors to discuss recommendations with the management of the activity under review, and Standard 15.1 requires the final communication to name the individuals responsible and the planned completion date. A date that management never believed in is the first cause of overdue items. Build dates from the work: a configuration change that needs a vendor release cannot be done in 30 days, and a policy rewrite that needs legal review has its own lead time. Record dependencies in the tracker, such as "waiting on ERP release," so a delay with a reason can be told apart from inaction.

Split large findings into milestones. A finding on termination controls might have three: workflow built, workflow live, and re-test passed. Each milestone has its own owner and date, and internal audit validates each. The standard asks for follow-up using a risk-based approach, and milestones let the chief audit executive show progress on a high finding without declaring it closed early.

Mistakes to avoid

• Closing findings on management's assertion.
• Resetting due dates without approval or without keeping the original.
• Treating follow-up as an annual exercise. A quarterly cycle catches slippage early.
• Following up only on findings from the engagements on the current year's plan.

For the structure of findings that feed this process, see /us/blog/internal-audit-findings-criteria-condition-cause-and-effect-standard-14-3.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• The IIA, Global Internal Audit Standards (2024), Standards 8.1, 11.3, 11.5, 15.2: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error