A new audit committee member at Thornwood Retail asks what the internal audit function's ongoing monitoring of management action plans is meant to achieve, as distinct from carrying out a fresh engagement. Which description best characterises the purpose of monitoring action plans?
- AIt is a fresh risk assessment of the whole auditable area that replaces the original engagement's conclusions with updated ones.
- BIt is a process to track the disposition of agreed actions and confirm that management has implemented them or has accepted the associated risk. Correct
- CIt is a mechanism for internal audit to take ownership of the corrective actions and implement them on behalf of the responsible managers.
- DIt is a formal reissue of the engagement report each time an action falls due, restating the findings for the record.
Why A is wrong: A new risk assessment is a plausible-sounding aim, but monitoring focuses on the disposition of the agreed actions from a prior engagement rather than re-assessing the entire area.
Why B is correct: Correct: monitoring exists to establish whether agreed actions have been carried out or whether management has knowingly accepted the residual risk, which is the disposition the follow-up process is designed to capture.
Why C is wrong: Taking ownership might seem helpful, but implementing the actions would impair internal audit's objectivity; monitoring observes and confirms progress rather than performing the fixes.
Why D is wrong: Reissuing the report looks like diligent documentation, but monitoring tracks implementation status and does not require republishing the original findings on a schedule.