Internal audit follow-up evaluates how the organisation has responded to findings and whether its actions address the problem. Closing an action entry is not the same as demonstrating that the change works. Follow-up should connect the original requirement and evidence with correction, cause investigation, chosen action and later results.
The internal audit guide explains where this activity fits in the programme. The organisation needs practical arrangements for responsibility, timing, evidence and escalation that reflect the significance of its findings.
Begin with a clear finding
A process owner cannot investigate effectively if the finding says only poor control. It should identify the unmet requirement and relevant evidence. Clarify uncertainty before the response becomes a series of actions aimed at the wrong problem.
Assess affected work and immediate consequences. A missing release check may require examination of items already delivered, not just correction of the record sampled during the audit. The response should consider the extent of the problem using relevant evidence.
Do not confuse reconstructing a record with demonstrating that the original activity occurred. Where information is missing, describe the uncertainty honestly and determine what further evaluation or control is needed.
Separate correction from corrective action
Correction addresses the detected problem. Corrective action addresses its cause to prevent recurrence. In a fictional dispatch case, reviewing the affected shipment is different from changing the workflow that allowed dispatch without the required authorisation.
Cause investigation should test explanations. Staff error is rarely a complete account of why a system permitted a consequential gap. Examine workload, information, authority, equipment, interfaces and controls where relevant, without assuming that every problem has the same underlying cause.
Training may support a response, but it is not automatically the right corrective action. If the system permits release before approval, repeating an instruction may leave that mechanism unchanged.
Define responsibilities and evidence
Identify who owns the response, who can authorise changes and who evaluates the resulting evidence. Establish a due date proportionate to consequence and practical implementation. An interim control may be necessary while a permanent change is developed.
| Decision | Example evidence |
|---|---|
| Immediate issue addressed | Affected work reviewed and necessary correction recorded |
| Cause reasonably supported | Investigation linked to records and process conditions |
| Action implemented | Revised workflow installed and responsibilities communicated |
| Effectiveness evaluated | Later relevant cases show the control operating as intended |
This structure is illustrative. The organisation may use different forms, but it should be possible to distinguish these decisions in the records.
Plan effectiveness before declaring success
Specify what later evidence would show that the change worked. Consider the original failure conditions and a meaningful opportunity for recurrence. A control aimed at rare exceptions may need targeted testing rather than a large sample of ordinary cases.
Choose timing that fits the process. Reviewing the action immediately after implementation may confirm installation but provide little evidence of sustained use. Waiting too long may leave a serious weakness insufficiently monitored.
Define acceptance criteria carefully. No complaints this month may be weak evidence if the affected service was not delivered during that period. A more useful review examines whether relevant cases encountered the changed control and whether it performed as intended.
Evaluate the result objectively
The action owner should provide evidence, but the organisation should consider who can evaluate it fairly. Someone closely involved in implementing a solution may overlook its weaknesses. A suitable independent reviewer can be valuable for consequential changes.
If the evidence is inconclusive, record that status rather than forcing closure. If the problem recurs, reconsider the cause, action and assumptions. Reopening a finding can be appropriate when new information shows that the response was insufficient.
Avoid closing the issue merely because a revised procedure exists. Examine communication, actual use and resulting performance. The content of a document and operation of a process are related but different forms of evidence.
Escalate delays and recurring problems
An overdue action may reflect unclear ownership, lack of resources or disagreement about risk. Escalation should help resolve the obstacle rather than repeatedly move the date. Management needs a reliable picture of outstanding issues and their consequences.
Look for patterns across findings. Several local failures may share an interface problem or a weak change-management arrangement. Follow-up can reveal a broader issue that was not apparent from one audit.
The audit findings article explains how precise problem statements support this analysis. Preserve links between the original finding, response evidence and effectiveness decision so later reviewers can understand the reasoning.
A sound follow-up process provides evidence that learning has entered normal work. It avoids both premature closure and indefinite open actions, using the significance of the problem and actual results to guide decisions.
Where an action changes several linked processes, examine whether local improvements created new problems elsewhere. A dispatch restriction may prevent premature release while unintentionally delaying urgent customer communication. Review the intended benefit and relevant side effects rather than treating the control in isolation.