Recommendations, Action Plans and Agreed Actions

Introduction
Recommendations, action plans and agreed actions are how an internal audit engagement produces improvement. A well-documented finding that never leads to corrective action adds little value. The CIA Challenge Exam tests whether you understand how internal auditors turn findings into practical, owned and time-bound actions, and how they confirm those actions are implemented. The topic sits within Engagement Results and Monitoring. Under the IIA Global Internal Audit Standards (2024), it is anchored mainly in Standard 14.4 Recommendations and Action Plans and Standard 15.2 Confirming the Implementation of Recommendations or Action Plans. It also draws on Standards 11.5 (Communicating the Acceptance of Risks), 14.3 (Evaluation of Findings) and 15.1 (Final Engagement Communication).

1. Why This Topic Is Important
Value creation: The purpose of internal auditing is to strengthen the organization's ability to create, protect and sustain value. That happens only when weaknesses are fixed and opportunities are taken.
Accountability: Action plans assign clear ownership and deadlines, so responsibility for fixing problems stays with management.
Risk management: Corrective actions bring residual risk back within the organization's risk appetite.
Independence and objectivity: The way recommendations are developed and owned shows the correct boundary between internal audit and management. Internal audit advises. Management decides and implements.
Board and senior management oversight: Monitoring and escalation tell the board whether significant risks are being addressed or knowingly accepted.
Exam relevance: Questions frequently test who is responsible, what to do when management disagrees, how follow-up works, and when to escalate.

2. What It Is: Key Definitions
Recommendation: A course of action proposed by internal auditors to address a finding. It may correct a deficiency, mitigate a risk, address a root cause or capture an improvement opportunity.
Action plan: Management's own documented response to a finding. It describes what will be done, who will do it and by when.
Agreed action: An action developed collaboratively by internal auditors and management, with both parties agreeing it will address the finding.
Management response: Management's formal position on a finding. It may include acceptance, an action plan, partial agreement or disagreement.
Follow-up (monitoring): The process internal audit uses to confirm that recommendations or action plans have actually been implemented and are effective.

Under Standard 14.4, internal auditors determine whether to develop recommendations, request action plans from management, or collaborate with management to agree on actions. These actions aim to:
- resolve the differences between the established criteria and the existing condition;
- mitigate identified risks to acceptable levels;
- address the root causes of the findings;
- enhance or improve the activity under review where opportunities exist.

3. How It Works: The End-to-End Process
Step 1: Build on a well-developed finding.
A sound recommendation depends on a complete finding. Many practitioners use the 5 Cs:
- Criteria: what should be.
- Condition: what is.
- Cause: why the gap exists, identified through root cause analysis.
- Consequence (effect): the risk or impact.
- Corrective action: the recommendation or action plan.
Recommendations should target the root cause, not just the symptom. If staff skip a review step because they were never trained, fixing one transaction is not enough. Training and procedure changes address the cause.

Step 2: Evaluate significance.
Under Standard 14.3, findings are prioritized or rated based on significance, such as likelihood and impact. The urgency and depth of the recommended action should match the significance of the finding.

Step 3: Choose the approach.
- Auditor recommendation: Useful when internal audit has specialized insight, or when management needs direction.
- Management action plan: Management designs the solution, which promotes ownership. Management knows its operations best.
- Collaborative agreed action: Both parties develop the solution together. This often produces the most practical and accepted outcome.
Whatever the approach, the action should be specific, practical, cost-effective (benefits outweigh costs), proportionate to the risk, and aimed at the root cause.

Step 4: Discuss with management.
Internal auditors discuss findings, recommendations and proposed actions with management before finalizing the communication. This confirms accuracy, builds buy-in and reduces surprises.

Step 5: Document the action plan elements.
A good action plan includes:
- the specific actions to be taken;
- the owner, meaning the individual responsible for implementation;
- target completion dates;
- where relevant, interim milestones and the expected evidence of completion.

Step 6: Handle disagreement.
If management disagrees with a finding or recommendation, internal auditors should give management the opportunity to explain its position. Internal auditors must not simply drop or soften a valid finding to avoid conflict. If the disagreement cannot be resolved, the final communication states both internal audit's position and management's position, along with the reasons.

Step 7: Include actions in the final communication.
Under Standard 15.1, the final engagement communication includes the findings and their significance, the recommendations and/or action plans, the conclusions, and the responsibilities and timelines for agreed actions.

Step 8: Monitor and confirm implementation.
Under Standard 15.2, internal auditors confirm that management has implemented recommendations or action plans. They follow an established methodology, which typically includes:
- inquiring with management about progress;
- performing follow-up assessments using a risk-based approach, where higher-risk items get more rigorous verification such as testing or observation rather than reliance on inquiry alone;
- updating the status of actions in a tracking system;
- determining whether senior management has accepted the risk of not taking action.

Step 9: Escalate when necessary.
If management has not made progress according to the established timeline, the chief audit executive (CAE) determines whether to escalate. Escalation moves through the appropriate levels: operational management, then senior management, then the board.

Step 10: Address risk acceptance.
Under Standard 11.5, management may decide to accept a risk rather than act. If the CAE concludes that management has accepted a level of risk that exceeds the organization's risk appetite or tolerance, the CAE discusses the matter with senior management. If it is not resolved, the CAE communicates the matter to the board. Internal audit does not resolve the matter itself. Its role is to make sure the decision is visible to those responsible for oversight.

4. Roles and Responsibilities
Management: Owns the risks, decides on actions, implements them and provides evidence of completion.
Internal auditors: Identify findings and root causes, develop or evaluate recommendations, assess whether planned actions adequately address the risk, and verify implementation.
CAE: Establishes the follow-up methodology, tracks status, escalates overdue items and communicates risk acceptance issues.
Senior management: Ensures accountability, resolves escalations and makes risk acceptance decisions.
Board: Oversees overall status, receives escalations, including unacceptable risk acceptance, and supports internal audit's authority.

Key principle: Internal auditors must not implement corrective actions or take ownership of them. Doing so means assuming management responsibilities, which impairs objectivity and independence. Internal audit may advise on design, but management decides and acts.

5. Characteristics of Strong Recommendations and Action Plans
- Root cause focused: Prevents recurrence.
- Specific and actionable: Says clearly what must be done. 'Improve controls' is too vague.
- Risk-proportionate: The effort and cost fit the significance of the finding.
- Cost-effective: Benefits exceed the cost of implementation.
- Owned: A named, accountable person with the authority to act.
- Time-bound: Realistic deadlines, shorter for high-risk findings.
- Verifiable: Completion can be evidenced and tested.
- Agreed or clearly documented: Management's acceptance or disagreement is recorded.

6. Common Scenarios and Correct Responses
Management agrees but offers a weak action plan: Internal auditors evaluate whether the plan adequately addresses the risk and root cause. If it does not, they discuss alternatives with management. If the gap remains, they document their view and escalate if the risk is significant.
Management disagrees with a finding: Listen to management's explanation and reconsider the evidence. If the finding stands, report both positions in the final communication. Do not delete the finding.
Action is overdue: Follow up with the owner, update the tracking status, and have the CAE escalate through the appropriate levels based on significance.
Management says the action is complete: For significant risks, verify with evidence and testing before closing the item. Do not rely solely on management's assertion.
Management decides to accept the risk: Confirm that the decision was made by appropriate authority. If the CAE believes the accepted risk exceeds the risk appetite, discuss it with senior management and, if unresolved, communicate it to the board.
Management asks internal audit to fix the problem: Internal audit may provide advice, consistent with its mandate, but should not take ownership of implementation.

Exam Tips: Answering Questions on Recommendations, Action Plans and Agreed Actions
Tip 1: Management owns implementation. When a question asks who is responsible for corrective action, the answer is almost always management. Eliminate options in which internal audit implements, approves processes operationally or takes ownership.
Tip 2: Look for root cause. Prefer answer choices that address why a problem occurred over those that only correct the specific error found.
Tip 3: Disagreement means documenting both positions. The correct response to unresolved disagreement is to include management's position and the reasons in the final communication alongside internal audit's position. Removing the finding, delaying the report indefinitely, or going straight to the board for a routine issue are usually wrong.
Tip 4: Know the escalation sequence. Escalation is progressive and risk-based: management, then senior management, then the board. Unresolved risk acceptance that exceeds risk appetite goes to the board after discussion with senior management.
Tip 5: Follow-up must be risk-based. High-risk findings call for more rigorous verification, such as testing, and tighter deadlines. Low-risk items may be closed based on management's representation, depending on the methodology. Watch for wording such as 'most appropriate' or 'best'.
Tip 6: The CAE establishes the follow-up methodology. Questions about who sets up tracking and monitoring processes generally point to the CAE.
Tip 7: A complete action plan has three core elements. Look for what will be done, who is responsible and when it will be completed. An answer missing an owner or a date is usually incomplete.
Tip 8: Collaboration is preferred, but objectivity is not negotiable. Collaborating with management improves buy-in. However, internal audit must not water down conclusions to gain agreement.
Tip 9: Recommendations should be cost-effective and practical. An option that recommends an expensive control for a low-risk issue is usually not the best answer.
Tip 10: Recognize risk acceptance. Management is entitled to accept risk. Internal audit's role is not to override that decision but to make sure it is communicated appropriately when it exceeds risk appetite.
Tip 11: Read for the role. Identify whether the question asks about the internal auditor, the CAE, management or the board. Many distractors describe a correct action performed by the wrong party.
Tip 12: Watch for absolute words. Options containing 'always' or 'never', such as 'always test every recommendation', are often wrong because follow-up is risk-based.

Practice Questions
Q1. During an exit meeting, management disagrees with a significant finding and refuses to provide an action plan. What should the internal auditor do?
A. Remove the finding from the report.
B. Develop and implement the corrective action personally.
C. Allow management to explain its position and, if disagreement remains, include both positions in the final communication.
D. Immediately report the manager to the audit committee.
Answer: C. Disagreements are documented transparently. Escalation may follow depending on significance, but it is not the first step.

Q2. Management reports that a high-risk control deficiency has been remediated. What is the most appropriate follow-up?
A. Close the item based on management's email.
B. Obtain and test evidence that the control is designed and operating effectively before closing.
C. Wait until the next full audit cycle.
D. Ask the external auditor to confirm.
Answer: B. High-risk items warrant rigorous, evidence-based verification.

Q3. The CAE believes senior management has accepted a risk that exceeds the organization's risk appetite. After discussing it with senior management, the matter remains unresolved. What should the CAE do next?
A. Accept senior management's decision and take no further action.
B. Communicate the matter to the board.
C. Implement compensating controls.
D. Resign.
Answer: B. This is consistent with Standard 11.5.

Q4. Which recommendation best addresses repeated errors caused by staff being unaware of a new policy?
A. Correct the identified errors.
B. Increase the audit frequency.
C. Provide training on the policy and update procedures, with supervisory review.
D. Discipline the staff involved.
Answer: C. It addresses the root cause.

Summary
Recommendations, action plans and agreed actions turn audit findings into improvement. Internal auditors decide whether to recommend, request or co-develop actions that address root causes and reduce risk to acceptable levels. They discuss these actions with management and document owners and timelines. Where disagreement cannot be resolved, both positions are reported. Internal audit then confirms implementation using a risk-based methodology, escalates overdue actions and communicates unacceptable risk acceptance to the board. Throughout, management owns the actions, and internal audit maintains its objectivity. Remembering this division of roles answers most exam questions on this topic.