For internal audit findings and recommendations to be effectively implemented and to ensure that they receive adequate consideration, formal follow-up procedures are essential. According to IIA guidance, it is important that the internal audit activity not only reports the results to management but also ensures that corrective actions are taken or that management consciously accepts the associated risks.
Detailed Explanation:
IIA Standard 2500 - Monitoring Progress:
This standard requires that the chief audit executive (CAE) establish a process to monitor and ensure that management actions are effectively implemented or that risks are appropriately accepted. Follow-up is crucial for verifying that management has taken the recommended actions or has acknowledged and accepted the risk of not doing so.
Formal Follow-Up Procedures:
These procedures involve tracking the status of management's responses to audit recommendations, checking if actions were implemented as planned, and determining whether the intended outcomes were achieved. If management decides not to act, the CAE must ensure that the decision is documented and the associated risks are understood and accepted by senior management.
IIA Practice Advisory 2500-1:
This advisory emphasizes the importance of follow-up to ensure that significant audit findings and recommendations are addressed. Without this follow-up, there is a risk that important issues might be neglected or forgotten.
Why Not Other Options?
Option A (Reporting results with recommendations): While reporting is important, it does not ensure that recommendations are acted upon.
Option C (Quarterly reporting on audit plan focus): This is related to audit planning, not to ensuring that specific findings and recommendations are considered.
Option D (Discussing findings with independent auditors): This might be useful, but it does not directly influence whether management considers and acts on the internal audit findings.