Note: Under the current CIA syllabus, communicating engagement results and monitoring progress is usually covered in Part 2. Collaborating with management to agree on actions is the step where internal auditors and the responsible managers turn engagement findings into practical, owned plans to fix…Note: Under the current CIA syllabus, communicating engagement results and monitoring progress is usually covered in Part 2. Collaborating with management to agree on actions is the step where internal auditors and the responsible managers turn engagement findings into practical, owned plans to fix problems. Under the IIA's Global Internal Audit Standards (Standard 14.4, Recommendations and Action Plans), auditors develop recommendations or identify opportunities for improvement. They then discuss these with management, who is responsible for creating and carrying out action plans.
The process usually starts before the final report. Auditors share preliminary findings in exit meetings or draft reports. This lets management confirm the facts, give context, and raise concerns. The goal is to agree on the condition, criteria, root cause, and effect of each finding. Root cause matters most, because an action plan that only treats symptoms is unlikely to stop the problem from recurring.
Management then proposes specific actions. Each action should have a clearly named owner and realistic completion dates. Auditors assess whether the planned actions actually address the root cause and reduce risk to an acceptable level. The auditor's role is advisory. Auditors can challenge weak plans and suggest alternatives, but they should not take ownership of implementation. Taking ownership would impair their objectivity.
If auditors and management disagree, the engagement communication should present both positions fairly. If management accepts a level of risk that the chief audit executive believes exceeds the organization's risk appetite, the CAE must discuss it with senior management (Standard 11.5, Communicating the Acceptance of Risks). If the matter remains unresolved, the CAE escalates it to the board.
The agreed actions are documented in the final engagement communication. They also form the basis for monitoring. Under Standard 15.2, Confirming the Implementation of Recommendations or Action Plans, the internal audit function follows up to confirm the actions were implemented effectively. It then reports the status to senior management and the board.
Effective collaboration builds trust, improves buy-in, increases implementation rates, and strengthens internal audit's value as a trusted advisor while preserving independence.
Collaborating with Management to Agree on Actions: A Complete CIA Exam Guide
Overview Collaborating with management to agree on actions is the stage where internal auditors and the people responsible for the audited activity discuss engagement findings and settle on practical steps to address them. It turns audit observations into real improvements in governance, risk management and control. For the CIA exam, it sits within Engagement Results and Monitoring. It links closely to communicating results, monitoring progress and handling management's acceptance of risk.
Why It Is Important 1. Ownership drives implementation. Management owns the processes, risks and controls. Actions that management helps design are far more likely to be implemented than recommendations imposed by audit. 2. Practicality and cost-effectiveness. Management knows the operational constraints, resources and systems. Working together produces actions that fix the root cause at a sensible cost. 3. Accuracy of findings. Discussing findings before the final report lets auditors confirm facts, fix misunderstandings and avoid disputes later. 4. Credibility and relationships. A collaborative approach builds trust and positions internal audit as a value-adding partner rather than a fault-finder. 5. Standards compliance. The IIA Global Internal Audit Standards (2024) expect auditors to develop recommendations or action plans and to discuss them with management. Specifically: - Standard 14.4, Recommendations and Action Plans, covers developing recommendations and discussing them with management. - Standard 15.2, Confirming the Implementation of Recommendations or Action Plans, covers follow-up.
What It Is It is a structured dialogue between the internal auditor and management of the activity under review. The goals are to: - validate the condition, criteria, cause and effect of each finding; - agree on the significance and priority of each finding; - develop recommendations or let management propose its own action plans; - assign an owner for each action; - set realistic target dates for completion; - record management's responses in the final engagement communication.
Key principles to remember: - Management is responsible for deciding on and implementing actions. Internal audit recommends, advises and monitors, but does not take on management's responsibility. Doing so would impair objectivity. - Auditors stay objective. Collaboration does not mean watering down findings or removing significant issues because management disagrees. - Agreement is not always reached. When it is not, the disagreement and both positions are documented.
How It Works: The Process Step 1: Interim communication. Findings are shared as they arise during fieldwork, so management is not surprised and can sometimes start fixing issues early.
Step 2: Closing (exit) meeting. The auditor presents draft observations to the right level of management. These are people who understand the issues and have authority to commit to action.
Step 3: Root cause discussion. Both parties identify why the condition happened. Effective actions address the cause, not just the symptom.
Step 4: Developing actions. The auditor may make recommendations, or management may propose an action plan. Good actions are: - specific; - assigned to a named owner; - time-bound; - proportionate to the risk; - focused on the root cause. In advisory engagements, the nature of agreed actions depends on the terms agreed with the client.
Step 5: Management responses. Management provides written responses stating agreement or disagreement, the planned action, the responsible person and the completion date. These are usually included in the final report.
Step 6: Resolving disagreements. - If management disagrees with a finding or the proposed action, the auditor considers whether new evidence changes the conclusion. - If the conclusion stands, both views are recorded in the report. - If management accepts a level of risk that the Chief Audit Executive (CAE) believes exceeds the organization's risk appetite, the CAE discusses it with senior management. - If the matter remains unresolved, the CAE communicates it to the board (Standard 11.5, Communicating the Acceptance of Risks).
Step 7: Final communication and monitoring. The agreed actions are distributed in the final report. Internal audit then tracks implementation through follow-up, which may include: - obtaining evidence that actions were completed; - re-testing controls; - reporting the status of open actions to senior management and the board.
Common Exam Scenarios - Management disagrees with a finding. What should the auditor do? - Who is responsible for implementing corrective action? - Management proposes an action different from the auditor's recommendation. Is that acceptable? - Management accepts a high risk and refuses to act. What is the CAE's next step? - What is the main purpose of the exit meeting? - What makes a management action plan effective?
Exam Tips: Answering Questions on Collaborating with Management to Agree on Actions Tip 1: Management owns the action. Reject options where internal audit implements corrective actions, designs and runs controls, or makes management decisions. These impair objectivity.
Tip 2: Alternative actions are acceptable if they address the risk. If management proposes a different but effective solution, the best answer is usually to accept it. The goal is mitigating the risk and root cause, not adopting the auditor's exact wording.
Tip 3: Do not delete or soften valid findings. When management disagrees, the correct response is to: - re-examine the evidence; - revise the finding only if new facts justify it; - otherwise document both positions in the report.
Tip 4: Know the escalation path. For unacceptable risk acceptance, the sequence is: auditor raises it with management, then the CAE discusses it with senior management, then the CAE escalates to the board if unresolved. Avoid options that jump straight to the board or to external regulators without first discussing with senior management.
Tip 5: Look for owner, action and date. The strongest action plan answers include a responsible person, specific steps and a target completion date, and address the root cause.
Tip 6: Prefer early and ongoing communication. Answers favoring interim communication and an exit meeting before the final report are generally correct. Surprises in the final report are poor practice.
Tip 7: Agreement does not end audit's role. Internal audit must monitor and follow up on agreed actions. Watch for distractors claiming the engagement is complete once management agrees.
Tip 8: Read for the BEST or MOST appropriate answer. Several options may seem reasonable. Choose the one that balances collaboration, objectivity, management accountability and compliance with the Standards.
Tip 9: Use the right level of management. Discussions and agreements should involve people with authority to commit resources and implement changes, not just junior staff.
Quick Recap - Collaboration means: - validating findings with management; - agreeing on practical, root-cause-focused actions with owners and deadlines; - recording management responses; - escalating unresolved risk acceptance; - monitoring implementation. - Always remember: management decides and implements; internal audit recommends, remains objective, reports and follows up.
