CIA-3 - Engagement Results and Monitoring (45% of the exam) - Section D.8
Describe the process for monitoring and confirming the implementation of management action plans, and the escalation process if an action plan has not been adequately implemented.
Recognise the internal audit function's responsibility for following up on and tracking management's implementation of agreed action plans, and distinguish the key steps for monitoring and confirming that implementation. Recognise the appropriate parties involved in the escalation process, and the proper sequence of steps to follow, when management has not adequately implemented an action plan.
Action plan follow-upEscalation processManagement action monitoring
Practice question for this objective
lock_openFree sampleEngagement Results and Monitoringmedium
A new audit committee member at Thornwood Retail asks what the internal audit function's ongoing monitoring of management action plans is meant to achieve, as distinct from carrying out a fresh engagement. Which description best characterises the purpose of monitoring action plans?
AIt is a fresh risk assessment of the whole auditable area that replaces the original engagement's conclusions with updated ones.
BIt is a process to track the disposition of agreed actions and confirm that management has implemented them or has accepted the associated risk.check_circle Correct
CIt is a mechanism for internal audit to take ownership of the corrective actions and implement them on behalf of the responsible managers.
DIt is a formal reissue of the engagement report each time an action falls due, restating the findings for the record.
Monitoring management action plans tracks the disposition of agreed actions, confirming implementation or a documented acceptance of the residual risk. The purpose of monitoring is to determine the disposition of each agreed action, either confirmed implementation or an explicit acceptance of risk, rather than re-auditing the area or performing the corrective work.
Why A is wrong: A new risk assessment is a plausible-sounding aim, but monitoring focuses on the disposition of the agreed actions from a prior engagement rather than re-assessing the entire area.
Why B is correct: Correct: monitoring exists to establish whether agreed actions have been carried out or whether management has knowingly accepted the residual risk, which is the disposition the follow-up process is designed to capture.
Why C is wrong: Taking ownership might seem helpful, but implementing the actions would impair internal audit's objectivity; monitoring observes and confirms progress rather than performing the fixes.
Why D is wrong: Reissuing the report looks like diligent documentation, but monitoring tracks implementation status and does not require republishing the original findings on a schedule.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-3 bank for this domain.
Follow-up and escalation describe the same underlying activity, so a single missed due date converts routine tracking directly into board-level reporting without a separate decision being required.
errorWhy it is wrong: It is tempting because both activities respond to an overdue action, but it is wrong: escalation is a distinct step reached by judgement about inadequate implementation, not an automatic consequence of a missed date.
Rely on management to confirm in writing that each action plan has been completed, and close the matters on receipt of that confirmation.
errorWhy it is wrong: A written assurance from management is tempting because it is documented, but it rests on an unverified assertion and does not confirm the corrective action was actually effective.
Report the unimplemented action plan to the external auditors so the outstanding matter is independently recorded on the file.
errorWhy it is wrong: Involving the external auditors seems like a way to add rigour, but it bypasses the internal reporting line and is not the route for handling an unimplemented action plan.