Posted by: Robert Davis
AICPA, American Institute of Certified Public Accountants, Assurance Service, Attestation, Evidence, Follow-up Procedures, IFAC, Information Systems Audit and Control Association, International Federation of Accountants, ISACA, IT Audit, Procedures, Project Management, The IIA, The IIC, The Institute for Internal Controls, The Institute of Internal Auditors
While management is responsible for addressing assurance engagement findings and recommendations as well as tracking resolution status; audit is responsible for establishing policies, procedures, standards and rules for follow-up to determine whether previous findings and recommendations are adequately addressed as well as considered in planning future engagements. In this matter, IT auditors should comply with generally accepted audit follow-up procedures addressing the risks ordinarily associated with the audit area. Contextually, an appropriate amount of follow-up is necessary to assure the effectiveness of the corrective action process and to reestablish confidence in the item or service assessed. Therefore, the audit follow-up process normally includes carrying out sufficient, timely follow-up procedures to verify that management actions address weaknesses promptly.