Reporting Findings Already Resolved by Management: CIA Part 3 Guide
Overview
During an engagement, internal auditors often find a control weakness, error or noncompliance that management fixes before the final report is issued. The CIA exam regularly asks how such resolved or corrected findings should be treated. The core principle is simple. Significant findings are still reported, even when management has already corrected them. The report also recognizes the corrective action taken.
Why It Is Important
• Completeness and accuracy: Engagement communications must be accurate, objective, clear, concise, constructive, complete and timely. Leaving out a significant issue because it was fixed makes the report incomplete. It can also mislead readers about the condition that existed during the period under review.
• Board and senior management oversight: The board relies on internal audit to understand the state of governance, risk management and control. A weakness that existed may reveal deeper problems, such as poor monitoring, a weak control culture, or a pattern across units. Fraud or regulatory exposure may also have occurred while the control was failing.
• Historical and regulatory record: Regulators, external auditors and those certifying internal controls (for example, under SOX-type regimes) may need to know that a deficiency existed and when it was remediated.
• Credit to management: Reporting the corrective action shows management was responsive. This builds a constructive, balanced relationship and supports a fair report.
• Independence and objectivity: Management may pressure auditors to drop a finding because it is "already fixed." Agreeing to suppress a significant issue would impair objectivity and the integrity of internal audit.
What It Is
A resolved finding is an engagement observation where three things are true:
1. A gap existed between the condition (what is) and the criteria (what should be).
2. The auditor communicated the issue to management during fieldwork or at a closing meeting.
3. Management implemented corrective action before the final engagement communication was issued.
Under the IIA Global Internal Audit Standards, findings are evaluated and prioritized by significance (Standard 14.3). Recommendations and management action plans are documented (14.4). Conclusions are developed (14.5). The final communication includes significant findings, conclusions, recommendations and action plans (15.1). Earlier guidance (Practice Advisory 2410-1 under the old IPPF) said this directly: corrective actions taken during the engagement may be reported, with appropriate acknowledgment, rather than excluded.
How It Works in Practice
Step 1: Identify and evaluate the finding. Document the condition, criteria, cause and effect (the elements of a finding). Assess its significance using likelihood and impact.
Step 2: Communicate promptly. Discuss the issue with management during the engagement. Serious matters, such as fraud indicators or major control breakdowns, should be raised immediately.
Step 3: Management corrects the issue. Management may change a process, fix access rights, recover funds or update a policy.
Step 4: Verify the corrective action where practicable. Before stating that an issue is resolved, the auditor should obtain sufficient evidence that the action was implemented and works effectively.
• If the auditor has verified the fix, the report can say so.
• If the auditor has not yet verified it, the report should say that management reports the action has been taken. The fix will then be validated through follow-up (Standard 15.2, confirming implementation of recommendations or action plans).
Step 5: Decide how to report, based on significance.
• Significant findings: Include them in the final engagement communication. Describe the condition that existed and the risk it created. Then state that management has taken corrective action, and whether internal audit has confirmed it.
• Minor or insignificant observations: These may be communicated informally, through discussion or a management letter or memo, instead of the formal report. In this case the quick fix simply means no formal recommendation is needed. The work should still be documented in the engagement workpapers.
Step 6: Reflect in the overall conclusion and rating. A resolved issue may affect how the auditor rates the area. Remediation can lessen the severity of the conclusion. However, it does not erase the fact that the control failed during the period reviewed.
Step 7: Follow up. Track the action in the monitoring process if verification is still pending.
Example
An auditor finds that 12 terminated employees still had active system access. IT removes the access during fieldwork. The final report should do three things:
• Describe the deficiency and its risk.
• State that access was removed and that internal audit verified the removal.
• Address the root cause, such as the absence of an HR-to-IT termination notification process, if that has not been fixed.
Fixing the symptom (the 12 accounts) does not necessarily fix the cause. A recommendation on the underlying process may still be needed.
Common Misconceptions
• "If it is fixed, there is nothing to report." This is wrong for significant issues. The board must know about it.
• "Reporting a fixed issue is unfair to management." Acknowledging the corrective action makes the report balanced and fair.
• "Management's word that it is fixed is enough." The auditor should verify the action or clearly state that verification is pending.
• "Every trivial item must go in the formal report." Insignificant matters can be handled informally.
Exam Tips: Answering Questions on Reporting Findings Already Resolved by Management
1. Default best answer: "Include the finding in the final report and note the corrective action taken by management." Look for options that combine reporting with acknowledgment.
2. Eliminate omission answers: For significant matters, reject choices that say exclude the finding, delete it because it was corrected, or report it only orally to the auditee.
3. Watch the significance cue: If the stem says the issue is minor, insignificant or immaterial, the best answer may be informal communication with no formal report item.
4. Verification matters: If an option says the auditor should confirm the effectiveness of the correction before describing it as resolved, it is usually stronger than one that relies only on management's assertion.
5. Root cause versus symptom: If the fix addressed only the specific instances, the best answer may still include a recommendation addressing the underlying cause.
6. Pressure scenarios: If management asks the auditor to remove a corrected significant finding, the answer reflects objectivity. Keep the finding and acknowledge the fix. Escalate to the chief audit executive if needed.
7. Follow-up link: If the correction has not yet been verified, expect the correct answer to involve monitoring or follow-up to confirm implementation.
8. Keywords to favor: "acknowledge," "recognize corrective action," "balanced," "complete," "verify."
9. Keywords to distrust: "omit," "no need to report," "exclude since resolved," "rely on management's representation."
10. Think about the audience: Ask whether the board and senior management would want to know that this weakness existed. If yes, it belongs in the report.
Summary
Report significant findings even if management has already fixed them. Describe the condition and its risk, and credit management's corrective action. Verify the fix or flag it for follow-up, and address root causes. Handle trivial matters informally. This approach keeps engagement communications complete, accurate, balanced and objective, which is exactly what CIA Part 3 questions test.
