Part 2 C – 1V3.0

THE IIA’S CIA LEARNING SYSTEMTM

www.LearnCia.com

Section Topics

1. Determine appropriate follow-up activity by the internal audit activity

2. Identify appropriate method to monitor engagement outcomes

3. Conduct follow-up activity

4. Communicate monitoring plan and results

Part 2, Section C

Part 2 C – 2V3.0

THE IIA’S CIA LEARNING SYSTEMTM

www.LearnCia.com

Responsibility to Monitor Progress

Standard 2500.A1

“The chief audit executive must establish a follow-up process to monitor and ensure that management actions have been effectively implemented or that senior management has accepted the risk of not taking action.”

Standard 2500.C1

“The internal audit activity must monitor the disposition of results of consulting engagements to the extent agreed upon with the client.”

Final audit report

Recommendation #2

Recommendation #3

Recommendation #1

Part 2, Section C, Topic 1

Part 2 C – 3V3.0

THE IIA’S CIA LEARNING SYSTEMTM

www.LearnCia.com

CAE’s Monitoring Responsibility

Final audit report

Gaps, risks, and correction priority

Criteria for correcting shortcomings

Assessment against audit criteria

To ensure response, CAE should:• Establish appropriate time frame.

• Evaluate response against objectives of audit recommendations.

• Verify response through communication.

• Conduct follow-up audit, if necessary.

• Escalate, if necessary.Also see PA 2500-1, “Monitoring Progress.”

Part 2, Section C, Topic 1

Part 2 C – 4V3.0

THE IIA’S CIA LEARNING SYSTEMTM

www.LearnCia.com

Discussion Question

What should the CAE consider when determining appropriate follow-up?

Sample answer:• How significant is the condition?

• What will correcting the condition cost in money and time?

• What may result from failure of the corrective action?

• How soon should management respond?

Part 2, Section C, Topic 1

Part 2 C – 5V3.0

THE IIA’S CIA LEARNING SYSTEMTM

www.LearnCia.com

When Is It Time to Escalate?*

Is the recommendation still valid?

6

Were the objectives met by a different approach?

Is there hope of changing management’s mind?

Should implementation be delayed?

Is the recommendation key to resolving control issues?

Can achieving the recommendation be made easier and more desirable to management?

5

4

3

2

1

*US Government Accountability Office white paper, 1991.

Part 2, Section C, Topic 1

Part 2 C – 6V3.0

THE IIA’S CIA LEARNING SYSTEMTM

www.LearnCia.com

Elements of the Monitoring Plan

Who?

What?

How?When?

Monitorin

g

plan

Assign specific internal auditors and specialists from other areas if needed.

Translate objectives into measurable, observable criteria.

Restrict high-dollar transactions? Monitor computers? Do full audit?

Give management a time frame consistent with urgency.

Part 2, Section C, Topic 2

Part 2 C – 7V3.0

THE IIA’S CIA LEARNING SYSTEMTM

www.LearnCia.com

Process and Goals

Process Goals

Monitor management actions

Action taken? Finished or in progress?

Observation

Positive relations

Data collection

Document review

Data analysis

Interviews

Follow-up engagement?

Is focus of change on root cause?

What are the benefits?

Do benefits match expectations?

Part 2, Section C, Topic 3

Part 2 C – 8V3.0

THE IIA’S CIA LEARNING SYSTEMTM

www.LearnCia.com

Discussion Question

If management is making no progress in implementing recommendations, what might be the reason? What are some possible actions?

Sample answer:Possible obstacles to progress• Management resistance.• Unforeseen problems.• Recommendation has become

irrelevant.• Unavoidable delays.• Inadequate recommendation.

Possible actions• Talk through issues.• Develop alternative methods

to implement.• Schedule additional

monitoring.

Part 2, Section C, Topic 3

Part 2 C – 9V3.0

THE IIA’S CIA LEARNING SYSTEMTM

www.LearnCia.com

Standard 2060, “Reporting to Senior Management and the Board”: Adequate Response

CAE quarterly report

CAE quarterly report

• CAE charged to report periodically to senior management and the board.

• Charge includes quarterly reports on ongoing projects, including monitoring activities to follow up on completed engagements.

• CAE often reports in person at senior management or quarterly board meetings.

Ongoing projects

Ongoing projects

Ongoing projects

CAE quarterly report

Ongoing projects

CAE quarterly report

CAE quarterly report

Ongoing projects

CAE quarterly report

Ongoing projects

Part 2, Section C, Topic 4

Part 2 C – 10V3.0

THE IIA’S CIA LEARNING SYSTEMTM

www.LearnCia.com

Stop Monitoring and Report Results

• Emphasize benefits.• Use qualitative or quantitative

measures.• Be brief—one-page summary with

appendices as needed for support.• Discuss new issues as needed.

STOPReport results of monitoring

• Successful as planned

• Objectives met by alternate methods

• New conditions

Part 2, Section C, Topic 4

Part 2 C – 11V3.0

THE IIA’S CIA LEARNING SYSTEMTM

www.LearnCia.com

Discussion Question

What is the CAE’s responsibility if management’s response is inadequate?

Sample answer: • Inform new management of

recommendations.• Argue the case for recommendation if

management resists.• Escalate if risk warrants.

Part 2, Section C, Topic 4

Part 2 C – 12V3.0

THE IIA’S CIA LEARNING SYSTEMTM

www.LearnCia.com

End of Section C

Questions?

Part 2, Section C