Internal and Forensic Audit · Reporting under Internal Audit

Follow-up and Reporting to the Audit Committee in Internal Audit

Updated 11 October 2026 · Fact-checked

Follow-up is the internal auditor's check that management has actually acted on agreed recommendations. You track each action against an owner and a due date, verify closure with evidence, escalate delays, and report status, overdue items and unresolved risks to the audit committee and board in a concise, prioritised report.

Understand Follow-up and Reporting to the Audit Committee

An internal audit report is only useful if something changes after it is issued. Follow-up is the step that turns findings into corrective action. Without it, the same weaknesses return in the next audit.

Management owns the corrective action. The internal auditor does not fix the issue. The auditor agrees the action plan, records an owner and a target date for each recommendation, and later checks whether the action was done and whether it works.

Follow-up can be a desk review of documents, a confirmation from the action owner, or a follow-up audit with fresh testing. The depth depends on risk. A high-risk finding on cash controls needs re-testing. A minor documentation gap may need only evidence of the revised procedure.

The internal audit function usually reports functionally to the audit committee and administratively to a senior executive. This reporting line protects objectivity. The committee reviews audit plans, significant findings, the status of open actions and management's responses. It can press management on overdue items, and serious unresolved matters go to the board.

The external auditor also cares about this link. SA 610 (Revised) says that, where the external auditor plans to use internal audit work, the auditor reads the function's reports to understand the procedures performed and the related findings (para 22). The auditor also evaluates whether the work was properly planned, performed, supervised, reviewed and documented (para 23). Well-documented follow-up supports that evaluation.

Key rules to remember

Status of a recommendation: Closed (verified) | Partly implemented | Not implemented | Overdue | Risk accepted by management; Use clear status categories. Close an item only on evidence, not on a verbal assurance.
Action plan record: Finding + Risk rating + Recommendation + Owner + Target date + Status + Evidence; Every tracked item needs all seven elements. Missing owner or date is the usual cause of drift.
Implementation rate: Implementation rate (%) = Recommendations implemented ÷ Total recommendations due × 100; A simple tracking measure. Count only items that are due and verified, and show overdue items separately.
SA 610 (Revised) para 22: Read the internal audit reports on the work you plan to use; The external auditor reads them to understand the nature and extent of procedures performed and the findings.
SA 610 (Revised) para 23: Evaluate whether work was properly planned, performed, supervised, reviewed and documented; evidence was sufficient and appropriate; conclusions and reports were appropriate and consistent; Explains why follow-up documentation and consistent reporting matter.

How to solve Follow-up and Reporting to the Audit Committee questions

Use this order for any question on follow-up or reporting to the audit committee. It keeps your answer structured: provision, facts, conclusion.

1Identify what is asked: tracking of actions, a follow-up audit, or the content of the report to the committee or board.
2State the principle in one or two lines: management owns corrective action, internal audit verifies it, and the audit committee oversees.
3Apply the facts. Note the risk rating of each finding, the owner, the due date and the evidence available.
4Choose the follow-up method that fits the risk: desk review, confirmation, or re-testing in a follow-up audit.
5Set out the reporting: status summary, overdue and high-risk items, management's reasons for delay, and the auditor's view.
6Decide on escalation: repeated delay or risk acceptance on a significant item goes to the audit committee and, if needed, to the board.
7Conclude with a clear recommendation and a revised target date, and note the documentation to be kept.

Quickest way: OVER method: Owner, Verify, Escalate, Report

When to use it: Use it when time is short and the question asks what the internal auditor should do about unimplemented recommendations or how to report to the committee.

Owner: confirm each item has a named owner and a due date.
Verify: check closure with evidence and re-test where risk is high.
Escalate: take overdue or risk-accepted significant items to the audit committee.
Report: give a short status summary with ratings, and keep the committee's follow-up decisions on record.

Common mistakes in Follow-up and Reporting to the Audit Committee

Saying the internal auditor implements the recommendations.
Students mix up advice with management responsibility.
Fix: Write that management implements and internal audit only verifies, to protect objectivity.
Closing an item on management's assurance alone.
It looks efficient and avoids more testing.
Fix: State that closure needs evidence, and re-testing for high-risk items.
Treating follow-up as the same for every finding.
Students memorise one method.
Fix: Link the depth of follow-up to the risk rating of the finding.
Sending the full detailed report to the audit committee with no summary.
Students think more detail means more marks.
Fix: Say the committee needs a prioritised summary of significant findings, overdue actions and unresolved risks, with the detail available on request.
Ignoring the reporting line.
The functional and administrative lines are not separated.
Fix: State that internal audit reports functionally to the audit committee, which supports independence.
Not linking follow-up to the external auditor's reliance.
Students treat internal and external audit as separate topics.
Fix: Mention SA 610 (Revised): the external auditor reads the reports and evaluates planning, supervision, evidence and documentation before using the work.

Worked examples

Example 1

During an internal audit of Sundaram Textiles Ltd, six months ago, the auditor found weak approval controls over vendor payments. Management agreed to revise the approval matrix within three months. The date has passed and the action is not done. Advise how the internal auditor should proceed.

Show the solution

Principle: management owns corrective action; the internal auditor monitors it and reports on status.
Facts: the finding concerns payments, which usually carries significant risk. The agreed date has passed and no action is taken.
Step 1: ask the action owner in writing for the reasons for delay and a revised date.
Step 2: record the status as overdue and assess whether the exposure has grown, for example through unapproved payments in the meantime.
Step 3: perform a follow-up test of recent payments to see whether the weakness continues.
Step 4: report the item as overdue and high risk to the audit committee, with management's response.
Step 5: if management accepts the risk or delay continues, the committee decides whether to escalate to the board.

Answer: The auditor should record the item as overdue, obtain reasons and a revised date, re-test recent payments, and report it to the audit committee as a high-risk overdue item. The committee should press management and escalate to the board if the delay continues.

Example 2

Explain what the internal auditor of Bharat Components Ltd should include in the periodic report to the audit committee on the status of audit recommendations, and why the external auditor may read it.

Show the solution

Principle: the committee needs a concise, decision-useful summary, not every working paper.
Content 1: the number of recommendations issued, implemented and verified, partly implemented, not implemented and overdue.
Content 2: the high-risk findings with owner, original date and revised date.
Content 3: management's reasons for delay and any risks it has accepted.
Content 4: the internal auditor's view on whether the control environment is improving, and any limits on scope or access.
External auditor link: under SA 610 (Revised) para 22, the external auditor reads the reports on the work it plans to use to understand the procedures and findings.
Under para 23, the external auditor also evaluates whether the work was properly planned, performed, supervised, reviewed and documented, so clear status reporting helps that evaluation.

Answer: The report should give a prioritised status summary: counts by status, high-risk and overdue items with owners and dates, management's reasons, accepted risks and the auditor's overall view. The external auditor may read it to understand findings and judge the quality of the work before relying on it.

Exam tips

Structure answers as principle, facts and conclusion. Name the owner, the risk and the next step.
Always state that management implements and internal audit verifies.
For reporting questions, list the contents of a committee report in bullets and keep each point to one line.
When SA 610 (Revised) is relevant, cite paras 22 and 23 only for reading reports and evaluating the work. Do not add other paragraph numbers from memory.

Practice questions from Reporting under Internal Audit

Follow-up and Reporting to the Audit Committee in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Follow-up and Reporting to the Audit Committee: frequently asked questions

What is follow-up in internal audit?

It is the process of checking whether management has implemented agreed recommendations. The auditor tracks actions, verifies closure with evidence and reports the status. A follow-up audit is used where re-testing is needed.

Why does the internal auditor report to the audit committee?

The committee oversees the function and supports its independence. It reviews significant findings, overdue actions and management's responses. It can press management and take serious matters to the board.

How do you track audit action plans?

Keep a register with the finding, risk rating, recommendation, owner, target date, status and evidence. Review it regularly, mark overdue items and report them. Close an item only after verification.

Can the external auditor use internal audit reports?

Yes, where the external auditor plans to use the internal audit function's work. SA 610 (Revised) requires the auditor to read the reports and to perform sufficient procedures to judge whether the work is adequate for the audit.