This page has been archived.
Information identified as archived on the Web is for reference, research or recordkeeping purposes. It has not been altered or updated after the date of archiving. Web pages that are archived on the Web are not subject to the Government of Canada Web Standards. As per the Communications Policy of the Government of Canada, you can request alternate formats on the "Contact Us" page.
Subject: Principles For Internal Audit Follow-up Activity
Question concerning this notice should be directed to:
Policy and Special Projects,
Centre of Excellence for Internal Audit
Comptrollership Branch, TBS
Purpose And Scope
The purpose of this Policy Interpretation Notice (PIN) is to propose a set of principles for follow-up activity which supplements Internal Audit Standard No. 23. The proposed principles are discussed in more detail in the attached Position Paper. These may be used to guide departmental internal audit follow-up activity directly, or as a reference for the development of departmental policy/guidelines for this activity.
The major issues related to follow-up activity include scope, timing, frequency, depth, roles and purposes.
The role of internal audit as a control function, whose purpose is to review, verify and evaluate other organizational controls, is now reasonably well understood and accepted by most departmental and agency management. The continuation of that role beyond the audit report stage does not yet have the same degree of acceptance in all departments. This is due to the lack of agreement on the nature and extent of follow- up activity, and the varied approaches to its implementation. This is not surprising since the nature and extent of follow-up activity that is desirable is largely situation dependent.
Interpretation Notice Position
The principles suggested for guiding follow-up activity in departments and agencies are:
The Position Paper suggests that departments and agencies incorporate a requirement for action plan development and implementation, and associated follow-up activity in their internal audit policy and associated procedures, where they have not already done so. These activities are crucial to the effectiveness of the internal audit function.
The internal audit community is requested to provide comments to IASSD on the Position Paper. It is suggested that internal audit groups compare their existing follow-up practices to the principles recommended in the Position Paper and report instances where the suggestions provided will not achieve the effects intended.
Ultimately, the final position on audit follow-up will be incorporated within the standards or IACIA Internal Audit Handbook, as appropriate. Monitoring of follow-up practices in departments relative to the final position taken on audit documentation will be performed as part of the performance assurance review program of IASSD.
The role of the internal audit function, as the evaluator of management controls, is now reasonably well understood and accepted in most departments and agencies. Unfortunately, management's perception of the product of that role often tends to revolve around the internal audit report to the exclusion of other, equally relevant products such as those of the follow-up process. Consequently, the role of audit beyond the report stage does not yet have the same degree of acceptance in all departments. This is partly due to the lack of agreement on the nature and extent of follow-up activity that is desirable, and the varied approach to its implementation. This is not surprising since the nature and extent of follow-up activity that is desirable is largely situation dependent.
The purpose of this Position Paper is to propose a set of principles for follow-up activity which are meant to aid departmental decision-making as to the scope, timing, frequency, depth, roles and purposes of internal audit follow-up activity.
As mentioned, it is difficult to adopt precise, yet widely applicable rules for follow-up activity since it is situation dependent. Nevertheless, it is assumed there is general agreement that such an activity is desirable, and that providing some structure for it has utility and that it is possible to agree on the general principles which should guide its implementation.
What follows is a set of tentative principles proposed along with descriptions of their intent and rationale. The intention is that through an iterative series of dialogue, attempted use and feed-back steps we will arrive at a set of principles to guide the implementation of follow-up activity in departments and agencies, regardless of situation dependent parameters.
Internal audit functions should plan for and execute follow-up action on all audit observations and associated recommendations recorded in internal audit reports.
The follow-up process can only be delineated in conjunction with the final stage of the audit assignment process-report writing.
To simplify matters it is assumed that obtaining management's response (reaction to the finding, conclusion or recommendation) is a mandatory part of the report writing stage of the audit assignment process. This would make the development of management's action plan the first stage of the follow-up process, whether the action plan is incorporated into the internal audit report or not. Although the auditor may be called upon for clarification of contents during action plan development, the first formal internal audit activity in the follow-up process will normally be action plan review.
The nature, timing and frequency of follow-up action will depend on the substantive content of the audit conclusion and associated recommendation (its significance), and will vary with the stage in the process, with the milestones provided in the action plan, and with the sophistication of the departmental management process.
An essential component of the first stage is obtaining agreement from management that it intends to undertake corrective action. This may involve several stages of discussion and negotiation through the managerial hierarchy up to and including the Audit Committee and, in extreme cases, the deputy head alone. Other possible elements of the follow-up process include:
All of these follow-up process elements have potential value in encouraging action plan implementation, and as review mechanisms which enable the head of internal audit to provide advice to the deputy head. However, the two results oriented reviews, (c) & (d) and the repeat audit case, (e) could be used as indicators of effectiveness of the internal audit function as well. In fact one could make a strong case for on-site results reviews as being the means for determining the ultimate indicators of internal audit function effectiveness - all others being proxy-measures. The main weakness of that case would be the joint responsibility problem, which makes it difficult to distinguish between managements' and auditors' relative contribution.
Not all of the elements of the follow-up process would be justifiable in all cases. For example, those elements requiring on-site review are obviously more costly and would have to be weighed against the benefits foreseen. In any case, the extent of follow-up and use to which results are put should be a decision of the deputy head, on the advice of the Audit Committee, with appropriate input from the head of internal audit.
The requirement for follow-up, the respective roles and responsibilities, and minimum frequency requirements should be embodied in departmental internal audit policy and associated procedures.
Action plan development and implementation is the responsibility of management and the timing of follow-up action should coincide with normal managerial control points.
Follow-up activity for any specific audit entity should normally terminate when it has been overtaken by the succeeding departmental planning cycle. This provision is subject to modification by the Audit Committee where such action is deemed to be justified by circumstances. This general principle does not preclude repeat audits.
The head of internal audit is a staff adviser to management, particularly senior management. Follow-up activity contributes to this advice role. It is up to management to plan, implement and control the action plan. Therefore, the progress reports received by internal audit should be on a "copy to" basis, with the original destined for higher level management rather than being a "special" report created solely for the audit group. Normal superior-subordinate relationships should prevail; the purpose of the report being copied to the internal audit group is so that the head of internal audit can play the expected advice role. On-site reviews should be synchronized with associated management reviews, where possible.
In cases where an auditee area has a good plan implementation track record, all outstanding action plan items that have not been implemented at the time of the next planning cycle should automatically be overtaken by (included in) the plan for the coming period and, therefore, not need further follow-up by internal audit. This is, of course, the ideal case. In practice, there may be any number of reasons for continuing the follow-up activity. This decision has to be weighed against the resentment generated against unwarranted interference with on-going managerial processes (whether real or perceived). In any case, the impact of an audit conclusion, and associated recommendation decreases with time.
There is intrinsic value in maintaining on-going contact with the auditee.
The intrinsic value of on-going contact is undeniable, however, it may be carried out in many guises. If there is an on-going need for follow-up activity, it is simply more efficient to combine liaison and follow-up activities. If, on the other hand, follow-up is not justified, liaison can continue on its own merits, without the associated negative aura of control activity.
In conclusion, although action plan development and implementation, which results from internal audit recommendations is the responsibility of the auditee (i.e. management), the internal auditor has the usual associated responsibility of advising the deputy head/Audit Committee as to the adequacy of those processes.
To establish or strengthen the follow-up process it is suggested
that departments and agencies incorporate the requirement for action- plan
development, follow-up activity, and associated roles and responsibilities
of both management and internal audit, in their internal audit policies and