6.3Follow-up and audit quality management

An audit does not end with issuing the report. Only when it includes the follow-up that confirms whether the recommended improvement was actually carried out and the targeted risk was reduced is the audit complete. A systems auditor must judge how to confirm the remediation status with objective evidence rather than taking oral answers or a "done" report at face value, and verify whether the fix is effective (effectiveness), not merely formal. Furthermore, to keep the quality of the audit itself, internal quality management that reviews and supervises whether the working papers and conclusions are appropriate is indispensable—because if the auditor's judgment is wrong, trust in the whole audit is shaken.

6.3.1Follow-up and verifying the effectiveness of remediation

• Follow-up is an audit activity that later confirms whether the improvement was carried out as planned for items pointed out in a past audit. Because merely issuing a report may not advance remediation, only by performing follow-up does the audit contribute to the organization's risk reduction. If follow-up reveals unaddressed items or delays, they are reported to management again.
• Verify the effectiveness of remediation: follow-up confirms not the formal completion of "we handled it" but whether the fix actually reduced the targeted risk (effectiveness). For example, against a report that "access privileges were reviewed," confirm the actual privilege settings and verify whether departed-user accounts were truly disabled and the recurrence-prevention mechanism functions. Seeing through a merely formal fix (a response without real effect) is the heart of follow-up.
• Confirm follow-up with objective evidence too: confirming the remediation status is backed by objective evidence the auditor can obtain and check themselves (settings, logs, records, re-test results), not by taking the audited department's oral answers or self-declaration at face value. Treating only the words "it is handled" as evidence violates the principle of audit-evidence reliability. Evidence the auditor directly confirmed has higher reliability.

6.3.2Quality management of the audit work itself

• Audit quality management is the mechanism that keeps the quality of the audit work itself. A superior reviews and supervises whether each auditor's judgment and conclusion are sound and whether working papers are properly prepared and support the conclusion, correcting as needed. It curbs auditor error, oversight, and bias as an organization and secures the reliability of audit results.
• Review of working papers and internal evaluation: working papers are reviewed by a superior or reviewer other than the preparer, confirming whether the evidence sufficiently supports the conclusion and whether the audit procedures were performed as planned. In addition, the quality of the whole audit function is periodically revisited and improved through internal evaluation (self-assessment) or external evaluation. The discipline that auditors too are subject to being evaluated underpins the objectivity of the audit.

6.3.3Judgment in follow-up and quality management

Suppose a systems auditor pointed out "departed-user accounts not deleted" as a serious deficiency in the previous audit, and the audited department answers that "we performed a stocktake of access privileges and have remediated it." How to confirm this as follow-up is the question. Accepting the oral or written answer of "it is remediated" as evidence as-is and calling it done is wrong—by the principle of audit-evidence reliability, it must be backed by objective evidence the auditor can obtain and check themselves. So the auditor re-reconciles the actual access-privilege settings and the current user list against HR's roster of departed staff and confirms whether the departed-user accounts that remained last time were truly disabled. Going one step further, they verify not merely whether they disappeared this time but whether the recurrence-prevention mechanism (incorporating account disabling into the offboarding procedure, operating a periodic stocktake) actually functions (the effectiveness of the remediation). If the departed-user accounts were gone but the disabling was a one-off manual action with no recurrence-prevention mechanism in place, that is a "merely formal fix," judged insufficient for effectiveness, and reported to management again. Next, audit quality management. This follow-up conclusion and working papers are not completed by the assigned auditor alone; a superior or reviewer reviews them, checking whether the confirmed evidence sufficiently supports the conclusion that "effectiveness was verified" and whether procedures were performed as planned. If the working papers lack a record of objective evidence with "oral confirmation only," the reviewer points it out and requires re-obtaining evidence. By making the auditor's own judgment subject to review and supervision, the objectivity and reliability of the whole audit are secured. Follow-up that confirms effectiveness with objective evidence, and keeping the quality of the audit work itself through review, is the judgment after reporting.

6.3.4Section summary

• Follow-up later confirms that the improvement was carried out and verifies the effectiveness of remediation (whether risk actually dropped), not formal completion
• Even in follow-up, confirm with objective evidence (settings, logs, re-tests) rather than taking oral answers at face value, and see through a merely formal fix
• Audit quality management—review, supervision, and internal/external evaluation of working papers—checks the auditor's own judgment too, securing the objectivity and reliability of the audit