Escalating Unimplemented Action Plans

Overview
Escalating unimplemented action plans is how internal audit responds when management has agreed to fix an issue found in an engagement but has not done so by the agreed date, or will not do so at all. It sits within the Engagement Results and Monitoring domain of the CIA Challenge Exam. It links two ideas: monitoring and follow-up of engagement results, and communicating the acceptance of risks.

Under the IIA Global Internal Audit Standards (2024), the two most relevant requirements are:
• Standard 15.2, Confirming the Implementation of Recommendations or Action Plans
• Standard 11.5, Communicating the Acceptance of Risks

The older IPPF (2017) covered the same ideas in Standard 2500 (Monitoring Progress) and Standard 2600 (Communicating the Acceptance of Risks). Exam questions may use the wording of either framework.

Why It Is Important
• Audit value depends on action. A finding that is never fixed does not improve governance, risk management or control. If action plans are not tracked and escalated, internal audit becomes a reporting exercise rather than an assurance function.
• It keeps accountability with management. Management owns risk and controls. Escalation makes sure that whoever chose not to act is accountable at the right level.
• It protects the board's oversight role. The board or audit committee needs to know when significant risks remain open. Hiding unaddressed risks would undermine governance.
• It preserves independence and objectivity. Internal audit does not fix the problem or force management to act. It reports the status transparently, which protects its independence.
• It meets the Standards. The CAE must establish a process to monitor and confirm implementation, and must escalate risk acceptance that may be unacceptable to the organization.

What It Is
Escalation is the structured process of raising the status of overdue, stalled or rejected action plans to progressively higher levels of authority. Escalation is triggered when:
• Action plans pass their agreed due dates without adequate progress.
• Management repeatedly extends deadlines without good reason.
• Implemented actions do not actually reduce the risk, meaning the control is ineffective.
• Management decides to accept a risk instead of addressing it, and the CAE believes that risk exceeds the organization's risk appetite.

A key distinction for the exam:
• Management may legitimately accept risk. Senior management can decide not to act, as long as the decision is informed, authorized and within risk appetite.
• The CAE's role is not to overrule management. The CAE must first discuss the matter with senior management. If the matter is still unresolved, the CAE must communicate it to the board.

How It Works: The Escalation Process
Step 1: Establish the follow-up process in advance.
• The CAE sets up a methodology for tracking action plans, often with an issue-tracking system.
• The methodology defines owners, due dates, evidence requirements, follow-up frequency and escalation thresholds.
• These thresholds are documented in the internal audit methodology and agreed with the board, often through the charter or audit committee guidance.

Step 2: Agree on action plans at the end of the engagement.
• The final communication records management's agreed actions, responsible owners and target dates.
• Clear, specific and measurable actions make escalation easier to justify later.

Step 3: Monitor and follow up.
• Internal audit periodically requests status updates and evidence.
• The depth of follow-up depends on risk. High-risk issues may need testing to confirm the fix works, while low-risk issues may only need management's self-certification.

Step 4: First-level escalation (operational).
• Overdue items are raised with the action owner and their direct manager.
• Internal audit seeks the reason for the delay and a revised, realistic plan.

Step 5: Senior management escalation.
• Where delays continue or the risk is significant, the CAE raises the matter with senior management, such as the CEO, CFO or a relevant executive.
• This is where the risk-acceptance discussion happens. Senior management either commits resources and a new timeline, or formally accepts the risk.

Step 6: Board escalation.
• If the CAE concludes that management has accepted a level of risk that may be unacceptable to the organization, and discussion with senior management does not resolve it, the CAE must communicate the matter to the board or audit committee.
• Boards also receive regular summary reporting on the status of open, overdue and accepted-risk items, including aging and trends.

Step 7: Document and close.
• Every step is documented, including evidence of implementation, management's rationale for accepting risk, and communications with senior management and the board.
• Items are closed only when evidence shows the action is complete and effective, or when risk acceptance is formally documented by the appropriate authority.

Factors That Influence Escalation
• Significance of the risk: its impact, likelihood and regulatory exposure.
• How long the item has been overdue and how many extensions it has had.
• Whether compensating controls exist.
• Changes in circumstances, for example the process has been discontinued or the risk has changed.
• The organization's risk appetite and tolerance.
• Management's responsiveness and the credibility of revised plans.

What Internal Audit Should NOT Do
• Implement the corrective action itself, because this impairs objectivity.
• Go straight to the board without first discussing the matter with senior management, unless the issue involves senior management itself, such as fraud or a conflict of interest.
• Quietly drop or close overdue items because management is uncooperative.
• Force management to accept its recommendation. Internal audit advises and reports. It does not make management decisions.
• Ignore regulators. However, reporting externally is normally governed by law, the charter and organizational policy, and is not the default escalation route.

Exam Tips: Answering Questions on Escalating Unimplemented Action Plans
1. Know the escalation order.
• The path is: action owner, then their management, then senior management, then the board.
• When a question asks what the CAE should do first about an unacceptable risk acceptance, the answer is usually to discuss it with senior management.
• When senior management discussion has already failed, the answer is to communicate it to the board.

2. Look for the word 'unacceptable'.
• Escalation to the board is required when the CAE concludes management has accepted a level of risk that may be unacceptable to the organization.
• Risk acceptance within appetite, made by an authorized person, does not need board escalation beyond normal reporting.

3. Watch for answers that break independence.
• Reject options where internal audit fixes the control, approves management's risk acceptance, or takes ownership of the action plan.

4. Responsibility versus accountability.
• Management is responsible for implementing actions.
• The CAE is responsible for establishing and maintaining a monitoring and follow-up process.
• The board oversees the process and receives escalated items.

5. Follow-up should match the risk.
• For high-risk findings, the best answer usually involves testing or verifying implementation, not just accepting management's word.
• For low-risk findings, self-certification may be enough.

6. Documentation is always a strong supporting element.
• Answers that include documenting management's rationale, evidence and escalation communications reflect good practice.

7. Beware of distractors.
Common wrong answers include:
• Reporting directly to external regulators as a first step.
• Issuing a new audit report or redoing the engagement immediately.
• Closing the finding because management disagrees.
• Waiting until the next scheduled audit to raise the issue.

8. Exceptions involving senior management.
• If senior management is the source of the problem, for example the CEO refuses to address a fraud-related control, direct communication with the board is appropriate.

Sample Exam-Style Scenarios
Scenario 1: A high-risk access control finding is 9 months overdue. The process owner keeps extending the deadline. What should the CAE do next?
Best answer: Raise the matter with senior management to get a commitment or a formal risk-acceptance decision. If the outcome is unacceptable, report it to the board.

Scenario 2: Senior management formally decides not to implement a recommendation because of cost. The CAE believes the remaining risk exceeds the organization's risk appetite. What is required?
Best answer: Having already discussed it with senior management, the CAE must communicate the matter to the board.

Scenario 3: Management states that an action plan is complete. The finding was rated high risk. What should internal audit do?
Best answer: Obtain evidence and test that the action has been implemented and is operating effectively before closing the item.

Scenario 4: A business unit was sold, so an open action plan is no longer relevant. What should internal audit do?
Best answer: Document the change in circumstances, confirm the risk no longer applies, and close the item with appropriate approval and reporting.

Key Takeaways
• Monitoring and escalation make sure audit findings lead to real risk reduction.
• Escalation is graduated and risk-based, ending with the board when risk acceptance may be unacceptable.
• The CAE discusses the matter with senior management before going to the board, except where senior management is implicated.
• Internal audit reports and advises, but never takes ownership of remediation or risk acceptance.
• Thorough documentation and regular status reporting to the board are hallmarks of an effective follow-up process.