What it is
The action owner uses this form to respond to a finding: whether they agree, what caused it, what they will do, by when, and what evidence will show it is done. Internal audit follows the action to closure and verifies it before closing.
The form also covers interim measures that reduce the risk in the meantime and an extension request that needs sponsor approval, and the audit committee’s if the rating is high.
When to use it
- After each internal audit finding.
- When a due date has to move.
- For the evidence file used to close a finding.
What’s inside
- Management’s position and root cause
- Corrective action steps with owners, dates and evidence
- Interim measures, resources and extension request
- Verification by internal audit and sign-off
Standard cited
This template follows IIA Global Internal Audit Standards (2024). It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Why ask for the root cause?
An action that fixes only the symptom does not stop the issue from happening again. The root cause makes the action fit the problem.
Who can approve a delay?
The executive sponsor, and for a high-rated finding the audit committee, as your policy sets. The form records both.
Related templates
- Control Remediation Tracker
- Internal Audit Report Template
- Root Cause Analysis (5 Whys and Fishbone)
- Audit Finding Sheet (5 Cs)
Last updated 11/05/2026. All free templates.