My thanks to Hal Garyn for raising this issue in a recent LinkedIn post. He relates:
Internal audit should, of course, be doing follow-up on key/material audit observations, but it is management that owns not only the corrective actions but to do its own follow-up. This was confirmed yesterday …
Yesterday (July 24), the European Central Bank (ECB) issued an exposure draft entitled “Draft Guide on Governance and Risk Culture.” When finalized, it is to replace a 2016 similar guide. Of the 66 pages, there are 4 that specifically address internal audit.
In reading these 4 pages, there are 6 things I found of interest to highlight.
I will cover each of these 6 items separately, over the next few days. Yesterday was on “cyclical auditing.”
Today … who owns follow-up on previously reported audit conditions?
They specifically state: “The role of the management body in its supervisory function, supported by the audit committee where established: these oversee and are accountable for the follow up process, while 𝘂𝗹𝘁𝗶𝗺𝗮𝘁𝗲 𝗿𝗲𝘀𝗽𝗼𝗻𝘀𝗶𝗯𝗶𝗹𝗶𝘁𝘆 𝗹𝗶𝗲𝘀 𝘄𝗶𝘁𝗵 𝘁𝗵𝗲 𝗺𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 𝗯𝗼𝗱𝘆.”
So, ultimate responsibility for follow-up lies with management, not internal audit. I fully…
