Obtaining Management Responses and Action Plans

Introduction
In the CRMA (Certification in Risk Management Assurance) domain Communicating Risk Management Assurance, one of the most practically important topics is obtaining management responses and action plans. An assurance engagement over risk management does not create value simply because the internal auditor identifies gaps. Value is created when management acknowledges the issue, commits to a specific corrective action, assigns ownership, and actually implements the fix. This guide explains why the topic matters, what management responses and action plans are, how the process works in practice, and how to recognize the correct answer when the exam tests you on it.

Why It Is Important
1. Closing the assurance loop. Risk management assurance is about providing the board and senior management with confidence that risks are identified, assessed, and managed within appetite. If a gap is reported but nobody owns the remediation, the organization's residual risk exposure remains unchanged and the engagement adds little value.
2. Accountability. A documented management response names a responsible person and a target date. This converts a vague observation into a measurable commitment that can be tracked by the board, the audit committee, and the risk function.
3. Compliance with the Standards. The IIA's International Standards require that final engagement communications include conclusions and, where appropriate, recommendations and/or action plans (Standard 2410 Criteria for Communicating). Standard 2500 requires the CAE to maintain a system to monitor the disposition of results, and Standard 2600 requires escalation when management has accepted a level of risk that may be unacceptable to the organization. Under the 2024 Global Internal Audit Standards, the same concepts appear in Standard 15.1 (Final Engagement Communication) and Standard 15.2 (Confirming the Implementation of Recommendations or Action Plans).
4. Preserving independence and clarity of roles. Management owns risks and controls; internal audit provides assurance. The management response process makes this division explicit: internal audit reports the condition, management decides how to respond.
5. Governance reporting. Boards and risk committees rely on aggregated action plan data (overdue items, repeat findings, accepted risks) to judge the health of the risk management framework.

What It Is
A management response is management's formal, written reply to each observation or finding in an assurance report. It typically states whether management agrees or disagrees with the finding and its risk rating, and explains what management intends to do.

An action plan is the specific set of steps management commits to in order to address the root cause of the issue. A well-constructed action plan contains:
- Agreement or disagreement with the finding and the assessed risk.
- Specific corrective actions that address the root cause, not just the symptom.
- A named action owner with the authority to implement the change.
- A realistic target completion date.
- Interim or compensating measures if full remediation will take time.
- Resources required, where relevant.
- Formal risk acceptance if management chooses not to act, including the rationale and the level of management approving the acceptance.

In a risk management assurance context, findings often relate to the design or operation of the ERM framework itself: incomplete risk registers, risk appetite statements not cascaded, key risk indicators not monitored, risk owners not assigned, or residual risk reported inaccurately. Management responses therefore frequently come from risk owners in the first line and from the risk management function in the second line, and the action plans may involve process, governance, or culture changes rather than a single control fix.

How It Works: The Process
Step 1 - Communicate during fieldwork. Good practice is to discuss potential observations with process and risk owners as soon as they are identified. This confirms facts, eliminates misunderstandings, and gives management time to begin thinking about remediation. Surprises at the closing meeting are a sign of poor communication.

Step 2 - Validate the observation. Each observation should be built on the classic elements: condition (what is), criteria (what should be), cause (why the gap exists), consequence or effect (the risk to the organization), and recommendation. Management can only write a meaningful action plan if the root cause is correctly identified. If the cause is misdiagnosed, the action plan will treat symptoms and the issue will recur.

Step 3 - Hold the closing or exit meeting. Present the draft observations, agree on facts and risk ratings, and formally request written management responses within a defined period (commonly 5 to 15 business days). Internal audit should explain what a complete response looks like but should not write the response for management.

Step 4 - Evaluate the adequacy of responses. The auditor assesses whether each response:
- addresses the root cause rather than the symptom;
- is specific and measurable, not a vague statement such as 'management will review the process';
- is achievable within the stated timeframe;
- identifies an appropriate owner with sufficient authority;
- reduces the residual risk to a level within the organization's risk appetite;
- is cost-effective relative to the risk.
If a response is inadequate, the auditor goes back to management to negotiate a stronger plan. Internal audit may suggest options but the final decision belongs to management.

Step 5 - Handle disagreement. When management disagrees with a finding or declines to act, the auditor first re-examines the evidence. If internal audit still believes the finding is valid, both positions are documented in the report. If management's decision amounts to accepting a residual risk that the CAE believes may be unacceptable to the organization, the CAE discusses the matter with senior management and, if unresolved, escalates it to the board (Standard 2600). The report should not be delayed indefinitely waiting for agreement; it can be issued with the disagreement noted.

Step 6 - Include responses in the final report. Management responses are normally reproduced in the final communication, often verbatim or in summary, alongside each observation. This gives readers, particularly the audit committee, a complete picture of the issue and the planned remediation. Responses must be included before the report is considered final.

Step 7 - Track and follow up. The CAE maintains a monitoring system that records every action plan, owner, and due date. Follow-up activities range from obtaining management's self-certification of completion to performing a verification engagement to confirm that the action was implemented and is effective. Overdue items, extensions, and repeat findings are reported to senior management and the board. Risk management assurance also feeds this information back into the ERM process, since an unresolved action plan represents a known uncontrolled risk.

Common Pitfalls
- Internal audit writing the action plan itself, which compromises independence and shifts ownership away from management.
- Accepting responses that only promise to 'investigate' or 'consider' without a concrete outcome.
- Allowing unrealistic due dates that guarantee the item will become overdue.
- Treating management's disagreement as the end of the matter instead of escalating risk acceptance.
- Failing to document interim controls while a long-term fix is implemented.
- Closing an action plan based solely on management's assertion when the risk is high and independent verification is warranted.
- Reporting only the symptom, so management fixes one instance rather than the underlying cause.

Exam Tips: Answering Questions on Obtaining Management Responses and Action Plans
Tip 1 - Remember who owns what. Management owns risk and the decision about how to respond; internal audit owns the assessment and the follow-up. Any answer that has internal audit designing, implementing, or taking responsibility for the corrective action is almost always wrong because it impairs independence and objectivity.

Tip 2 - Look for root cause. If a question asks about the 'best' or 'most effective' action plan, choose the option that addresses the underlying cause of the condition rather than one that corrects the specific errors found. Correcting the exceptions is necessary but not sufficient.

Tip 3 - Apply the SMART test. The best action plan is specific, measurable, achievable, relevant to the risk, and time-bound with a named owner. Eliminate options with vague wording such as 'management will monitor the situation more closely'.

Tip 4 - Know the escalation path for risk acceptance. When management decides to accept a risk and the CAE believes that risk may be unacceptable to the organization, the correct sequence is: discuss with senior management, then if unresolved, communicate to the board. The auditor does not simply drop the issue, does not override management's decision, and does not go directly to external parties.

Tip 5 - Disagreement does not stop the report. If the question describes management disagreeing with a finding, the correct response is to document both views in the report and issue it, not to remove the finding, not to delay the report indefinitely, and not to water the finding down to secure agreement.

Tip 6 - Timing of communication. Questions often test whether findings should be discussed during fieldwork. The correct answer favors early, ongoing communication with management rather than waiting until the draft report, because it prevents surprises and improves the quality of responses.

Tip 7 - Follow-up is mandatory, verification is risk-based. The CAE must have a process to monitor disposition of all results. The extent of follow-up work, however, is proportionate to risk: high-risk items generally require independent verification, while low-risk items may be closed on management's representation. Watch for options that treat all items identically.

Tip 8 - Interim measures matter. When an action plan has a long implementation timeline, the best answer typically includes compensating or interim controls to manage the risk in the meantime.

Tip 9 - Cost versus benefit. The Standards recognize that controls should be cost-effective. If an option recommends a control whose cost clearly exceeds the risk reduction, it is likely a distractor. Management may legitimately choose a less expensive alternative or accept the risk, provided the acceptance is made at the appropriate level and is documented.

Tip 10 - Link to the ERM framework. In CRMA questions, remember that unresolved action plans and accepted risks are themselves inputs to the organization's risk profile. Answers that connect follow-up results to risk reporting, risk appetite, and board oversight reflect the integrated thinking the CRMA exam rewards.

Tip 11 - Read the qualifier. Words such as 'first', 'most appropriate', 'best', and 'primary' change the correct answer. For 'first' questions in this area, the earliest logical step is usually to confirm the facts with management or to re-evaluate the evidence, not to escalate or issue the report.

Tip 12 - Standards vocabulary. Be comfortable with terms like 'disposition of results', 'residual risk', 'risk acceptance', 'action owner', 'target date', 'compensating control', and 'repeat finding'. The exam often paraphrases Standards language, so recognizing the underlying principle is more useful than memorizing exact wording.

Summary
Obtaining management responses and action plans is the mechanism that turns risk management assurance into risk management improvement. The internal auditor identifies and communicates the condition and its root cause, management decides how to respond and commits in writing to a specific, owned, time-bound plan, and the CAE tracks implementation and escalates unacceptable risk acceptance to the board. On the exam, choose the answer that respects management's ownership, targets root cause, keeps the report moving despite disagreement, and ensures the board is informed when residual risk may exceed appetite.