Monitoring and Follow-Up of Engagement Results

Overview
Monitoring and follow-up of engagement results is the final link in the internal audit engagement chain, and it is the step that converts an audit report from a piece of paper into actual risk reduction. In the IIA CRMA (Certification in Risk Management Assurance) syllabus, this topic sits within the domain on communicating risk management assurance, because follow-up is fundamentally about confirming that the risk responses management agreed to actually happened, and then communicating that status to senior management and the board. This guide explains why the topic matters, what the Standards require, how a sound follow-up process works in practice, and how to attack exam questions on it.

Why Monitoring and Follow-Up Is Important
An engagement communication identifies gaps between the current state of risk management and the desired state. Management then commits to action plans. If no one checks whether those actions were implemented, three problems arise:
1. Residual risk may remain unaddressed. The organization believes a risk has been mitigated when it has not, which creates a false sense of assurance for the board.
2. Accountability erodes. Managers learn that audit observations carry no consequence, and the control culture weakens over time.
3. Internal audit cannot give a reliable opinion. The chief audit executive (CAE) is expected to provide an overall assessment of governance, risk management and control. That assessment is only credible if the CAE knows which identified weaknesses remain open.
From a risk management assurance perspective, follow-up is also how internal audit verifies that the organization's risk registers, risk appetite statements and risk response plans are living documents rather than static artifacts. When an agreed action is not implemented, the real risk profile diverges from the reported risk profile, and that divergence is exactly what the board needs to know about.

What the Standards Require
Under the 2017 International Standards for the Professional Practice of Internal Auditing, Standard 2500 (Monitoring Progress) required the CAE to establish and maintain a system to monitor the disposition of results communicated to management. Standard 2500.A1 required a follow-up process to monitor and ensure that management actions have been effectively implemented or that senior management has accepted the risk of not taking action. Standard 2500.C1 said that for consulting engagements, follow-up is performed to the extent agreed with the client. Standard 2600 (Communicating the Acceptance of Risks) addressed what happens when management accepts a level of risk the CAE believes may be unacceptable to the organization.
Under the 2024 Global Internal Audit Standards, the same obligations appear in Principle 15 (Communicate Engagement Conclusions and Monitor Action Plans). Standard 15.2 (Confirming the Implementation of Recommendations or Action Plans) requires internal auditors to confirm that management has implemented recommendations or action plans, and the CAE must establish a methodology for this. Standard 11.5 (Communicating the Acceptance of Risks) carries forward the escalation duty regarding accepted risk. For exam purposes, know both the legacy numbering and the new numbering, because the CRMA exam may be framed using either, and the underlying principles are identical.
The three core requirements you must remember are:
- The CAE owns the follow-up process and methodology.
- Follow-up must confirm that actions were effectively implemented, not merely that management says they were.
- If management chooses not to act, the alternative acceptable outcome is that senior management has formally accepted the risk, and the CAE must escalate to the board if that accepted risk appears to exceed the organization's risk appetite.

How the Follow-Up Process Works
Step 1: Capture agreed actions at the end of the engagement. Each observation in the final communication should have an agreed management action, a named action owner, and a target completion date. Without these three elements, follow-up is impossible. Internal audit should record them in a tracking system or issues log immediately after the report is issued.
Step 2: Apply a risk-based approach. Follow-up effort is not uniform. The CAE determines the nature, timing and extent of follow-up based on the significance of the reported observation, the degree of effort and cost needed to correct the condition, the impact if the corrective action fails, the complexity of the action, and the time period involved. High-risk observations typically receive independent validation; low-risk observations may be closed based on management representation supported by evidence.
Step 3: Monitor progress against target dates. The tracking system is reviewed periodically. Internal audit contacts action owners as due dates approach and documents the status. Typical status categories are: implemented, partially implemented, not implemented, overdue, superseded or no longer applicable, and risk accepted by management.
Step 4: Validate implementation. For significant items, auditors obtain evidence that the control is designed and operating. This may be done through a dedicated follow-up engagement, through testing added to the next scheduled engagement in that area, or through review of documentation and re-performance. Management self-certification alone is generally insufficient for high-risk items.
Step 5: Handle non-implementation and risk acceptance. If management has not implemented an action and does not intend to, the CAE asks whether senior management has made a conscious, documented decision to accept the residual risk. If the CAE concludes that the accepted risk may be unacceptable to the organization, the CAE first discusses the matter with senior management. If the matter is not resolved, the CAE communicates it to the board. Note the sequence: senior management first, then the board. Internal audit does not resolve the risk itself; its role is to ensure the right people make an informed decision.
Step 6: Report follow-up status to senior management and the board. Periodic reporting typically includes the number of open and overdue actions, aging analysis, items by risk rating, trends, repeat findings, and any risk acceptances. This reporting feeds the CAE's overall opinion and supports the audit committee's oversight of risk management.
Step 7: Document and close. Each closed item should have sufficient documentation to show what evidence was obtained and who approved closure. Follow-up work is subject to the same supervision and quality requirements as other engagement work.

Follow-Up in a Risk Management Assurance Context
For CRMA candidates, the exam often frames follow-up around risk management processes rather than operational controls. Typical scenarios include confirming that a risk owner updated the risk register after an identified gap, verifying that a key risk indicator was implemented and is being monitored, checking that a risk response (avoid, reduce, share, accept) agreed at the risk committee was executed, or confirming that risk appetite breaches identified by internal audit led to corrective action. The principle is the same: internal audit confirms the agreed risk response was implemented effectively, and escalates when risk remains outside appetite without conscious acceptance by the appropriate level of management.
Remember the roles. Management (first and second line) owns risks and the actions to treat them. Internal audit (third line) provides assurance that those actions happened. Internal audit should never implement the corrective action itself, because that would impair its objectivity when assessing that same area later.

Common Misconceptions Tested on the Exam
- Misconception: Follow-up is optional if management agrees with the findings. Reality: Agreement is not implementation; follow-up is required for assurance engagements.
- Misconception: Every observation needs the same follow-up. Reality: The approach is risk-based.
- Misconception: If management accepts a risk, the CAE must immediately report to the board. Reality: The CAE first discusses with senior management; escalation to the board occurs only if the matter remains unresolved and the CAE believes the risk may be unacceptable to the organization.
- Misconception: Internal audit decides whether the risk is acceptable. Reality: Management and the board own that decision; internal audit ensures it is made consciously and transparently.
- Misconception: Follow-up of consulting engagements follows the same rules as assurance. Reality: For consulting, follow-up is performed to the extent agreed with the client.
- Misconception: A management email saying an item is fixed is enough to close a high-risk item. Reality: Significant items require evidence and validation.

Exam Tips: Answering Questions on Monitoring and Follow-Up of Engagement Results
1. Identify who the question is about. If it asks who is responsible for establishing the follow-up process, the answer is the CAE. If it asks who is responsible for implementing corrective action or accepting residual risk, the answer is management. Options that have internal audit implementing fixes or approving risk acceptance are wrong.
2. Look for the sequence words. Questions containing first, next, or most appropriate initial step are testing escalation order. For accepted risk, the order is: discuss with senior management, then report to the board if unresolved.
3. Favor the risk-based answer. When options describe how much follow-up to perform, the correct choice usually references significance of the risk, cost of correction, complexity, or time elapsed, rather than a fixed percentage or a uniform approach to all items.
4. Distinguish between confirming and accepting. The Standards say follow-up confirms actions were effectively implemented. An option that closes an item based solely on management assertion for a significant finding is a distractor.
5. Watch for the two acceptable outcomes. An open item can legitimately be resolved in only two ways: the action is implemented effectively, or senior management has accepted the risk of not acting. Any option implying a third path, such as internal audit withdrawing the finding because management disagrees, is incorrect.
6. Know the consulting exception. If the scenario is a consulting engagement, the correct answer typically references follow-up to the extent agreed with the engagement client.
7. Connect follow-up to board reporting. Questions asking what the CAE should include in periodic reports to the audit committee often expect overdue actions, significant open items, and risk acceptances, because these inform the board's oversight of the risk management framework.
8. Eliminate independence violations. Any option where internal audit designs and installs the control, owns the risk register, or decides the organization's risk appetite breaches objectivity and can be eliminated quickly.
9. Read for the word effectively. The Standards do not just ask whether actions were taken; they ask whether they were effectively implemented. An option that mentions verifying the control is operating as intended is stronger than one that merely confirms a policy was issued.
10. Use the Standards language as a tiebreaker. When two options seem plausible, the one that mirrors the Standards phrasing, such as monitor the disposition of results, confirm implementation of action plans, or communicate the acceptance of risks, is usually the intended answer.

Quick Revision Summary
- Purpose: ensure agreed risk responses are implemented or that risk is consciously accepted.
- Owner of the process: the CAE; owner of the actions: management.
- Approach: risk-based in nature, timing and extent.
- Evidence: validation proportional to risk; self-assessment alone is insufficient for significant items.
- Escalation: senior management first, board if unresolved and risk may be unacceptable.
- Consulting: follow-up as agreed with the client.
- Reporting: status of open, overdue and accepted items supports the CAE's overall opinion and the board's risk oversight.
Mastering these points will allow you to handle both the direct knowledge questions and the scenario-based questions the CRMA exam uses to test monitoring and follow-up of engagement results.