How much issue remediation validation does your Internal Audit Division do? Do they only validate remediation of issues identified by Internal Audit? Do they perform interim review during issue remediation?
Sort by:
We validate all issues that are reported in our final report, whether identified by management or by internal audit, and that have management action plans associated with them. We validate based on the nature of the issue (i.e., different approaches depending on whether there is a design vs. operating effectiveness type failure). We generally conduct our validation once the issue owner notifies us that the remediation is complete, and a period of time passes to allow any needed samples to generate. We do also make ourselves available during the remediation period to provide input and validation should the business have questions or want to pressure test planned approaches.
I would prefer my internal audit do not do remediation
Rather than can recommend what should be done and one agreed what will be done by relevant stakeholders, Internal audit can ensure the remediation work stays on track.
In my experience they can certainly do interim review during the remediation to make sure things are going according to plan. Of course, this depends on the magnitude of the issue in the first place and the impact it has to the business. For larger critical processes, I would hope there aren't huge issues, but if there were, having Internal Audit set interim reviews and expectations can help accelerate the remediation.
For all recommendations that appear in an Internal Audit report the business have to give us evidence that they have mitigated the identified deficiency. We only close the action once we are satisfied the evidence demonstrates remediation. We don't conduct interim reviews unless invited to do so by the business.