18.2 Evaluating the Adequacy of Management Action Plans

18.2 Evaluating the Adequacy of Management Action Plans

[!NOTE] Professional Standards Foundation: Under GIAS Standard 14.4 (Recommendations and Action Plans) and Standard 14.5 (Engagement Conclusions), internal auditors are required to determine whether management's proposed action plans address the risks identified in the findings and achieve the intended control outcomes. If the internal auditor concludes that a proposed action plan is inadequate, unfeasible, or fails to address the root cause, the auditor must communicate this assessment to management and reflect the evaluation within the final engagement communication.

Internal audit is not a passive transcription service. The auditor's professional responsibility does not conclude when management submits a written response to an audit finding. Accepting an unfeasible, superficial, or evasive action plan creates a dangerous governance hazard: it misleads the Audit Committee and executive leadership into believing that a risk has been contained when the vulnerability remains fully active. Therefore, internal auditors must rigorously evaluate proposed management action plans against objective criteria before finalizing and publishing the audit report.

---

The Three-Pillar Evaluation Framework

To determine whether a management action plan is professionally adequate, the internal auditor must evaluate the proposal against three foundational dimensions: causal alignment, temporal proportionality, and interim risk containment.

1. Causal Alignment (Root-Cause Sufficiency)

The proposed remediation must directly resolve the fundamental mechanism that allowed the breakdown to occur, rather than merely treating surface symptoms:

• Symptom vs. Root Cause: If an audit discovers $1.2 million in duplicate vendor payments because accounts payable clerks override matching warnings during peak volume, an action plan stating "Management recovered the $1.2 million and reprimanded the clerks" merely addresses the condition. It fails causal alignment.
• Structural Resolution: An adequate action plan targets the root cause: "By August 31, 2026, IT will disable manual matching overrides in the ERP system for invoices over $5,000, requiring automated managerial secondary approval."
• Feasibility Verification: The auditor must assess whether the proposed technology or process change is realistically capable of achieving the desired outcome within the organization's operating environment.

2. Temporal Proportionality (Risk-Commensurate Scheduling)

The remediation timeline must be directly proportional to the severity and velocity of the underlying risk exposure:

• High-Velocity / Critical Risks: Critical exposures (e.g., active cybersecurity intrusions, severe regulatory non-compliance with statutory stop-work penalties, or unsegregated multi-million dollar liquidity transfers) demand immediate containment within days or weeks. A management timeline proposing a 12-month review for an active high-risk vulnerability is fundamentally inadequate.
• Moderate / Low Risks: Operational efficiency enhancements or localized policy updates can accommodate longer execution windows (e.g., 6 to 9 months) aligned with normal operational planning cycles.
• Calendar Reality: Auditors must challenge timelines that appear arbitrary or convenient (e.g., blanket 90-day deadlines across all findings regardless of complexity) and verify that target dates do not conflict with major organizational freezes (such as year-end financial closes or holiday retail moratoria).

3. Interim Risk Containment (Compensating Controls)

When a comprehensive permanent solution requires an extended implementation runway (e.g., 9 to 18 months for core software development or plant re-tooling), the action plan must define interim compensating controls:

• What operational controls will protect the organization against loss tomorrow morning while the strategic system is being built?
• Examples include heightened supervisory sampling, dual manual sign-offs, daily exception reporting, or third-party monitoring contracts.
• Without interim compensating controls, an extended timeline leaves the organization exposed to unmitigated risk for an unacceptable duration.

---

Common Pathologies and Red Flags of Deficient Responses

Experienced auditors recognize predictable behavioral patterns when operational managers attempt to deflect or minimize audit findings. Identifying these red flags allows the auditor to intervene before the final report is published:

1. Evasive and Non-Committal Rhetoric

Management utilizes ambiguous language that avoids binding commitments. Phrases such as "Management will consider the feasibility of updating guidelines," "We endeavor to take appropriate measures as resources permit," or "The business unit has noted the observation and will keep it in mind during next year's strategy session" provide zero accountability. Such responses cannot be verified during follow-up testing because no concrete deliverable was promised.

2. Kicking the Can Down the Road (The Infinite Deferral)

Management links remediation to a distant, unconfirmed future event or enterprise initiative. A classic example is responding to an automated access control defect by stating: "Management will address this finding during the upcoming enterprise Cloud ERP migration scheduled for 2028." If the future project is unbudgeted, subject to scope delays, or two years away, management is effectively choosing to accept an unmitigated risk in the interim without formal governance authorization.

3. Subordinate Dumping (Authority Deficits)

Management designates a junior staff member, intern, or external contractor as the sole remediation owner (e.g., naming a junior compliance analyst as the owner for resolving an enterprise-wide data governance failure). The designated owner lacks the organizational stature, budgetary authority, and cross-functional leverage to enforce compliance across business units. Ownership must reside with an executive or director who possesses the authority to mandate operational changes.

4. Cosmetic Panaceas (Treating the Symptom)

Management proposes purely behavioral or clerical fixes to systemic structural breakdowns. Examples include issuing a company-wide email reminder, re-circulating an unread policy, or verbally counseling a staff member. When a process breaks down, behavioral reminders degrade within weeks. Sustainable remediation requires engineering controls into the workflow (e.g., system field validations, mandatory automated approvals, or physical interlocks).

---

Pre-Issuance Constructive Dialogue: Strengthening Weak Action Plans

When management submits a deficient or evasive action plan, the internal audit activity must not immediately publish a scathing rebuttal. Instead, the auditor executes structured pre-issuance engagement:

1. Diagnostic Challenge Sessions: The lead auditor meets with the process owner to review the deficiency. The auditor poses concrete stress-testing scenarios: "If we leave this process as proposed, how will your team detect unauthorized transactions next month before the ERP migration occurs?"
2. Benchmarking and Perspective Sharing: Without prescribing solutions, the auditor shares how comparable business units or industry peers have engineered cost-effective compensating controls, broadening management's perspective.
3. Formal Non-Endorsement Protocol: If management refuses to revise an inadequate action plan after constructive dialogue, the CAE must take definitive action. The CAE cannot alter or suppress the finding. In the final published engagement communication, internal audit must present the finding, publish management's response verbatim, and include an explicit Internal Audit Evaluative Commentary detailing why the proposed action plan is deemed inadequate to resolve the risk. This ensures the Audit Committee receives an unfiltered view of unmitigated organizational exposure.

---

Comparative Evaluation Matrix: High-Risk Scenarios