There are conflicting views on whether internal audit should follow-up on every action item from previous audits.
Let me see if I can inject some common sense into the debate.
Imagine this is the situation:
– A year ago, management agreed to a recommendation by internal audit to remove the access of 20 former employees to the financial system.
– Also a year ago, they agreed to monitor the issuance of credit notes after an audit found several had been processed without the prior approval of management.
– Nine months ago, internal audit recommended a periodic review of the policy for reviews of employee expense reports as if had not been updated in five years. Management agreed to update it within 60 days.
– After an internal audit, management committed to ensure all account reconciliations in a major subsidiary are completed before their financial team sends their results to Corporate. That action should have been completed six months ago.
– After last year’s external audit, management agreed with the external auditors’ recommendation to improve controls over the receipt of materials.
– A year ago, the SEC told management to improve their risk disclosures.
– Six months ago, the EPA found errors in the company’s emissions reporting. Management agreed to correct them immediately.
– In their…
