What's changed: Initial version
6.3Follow-up and audit quality management
Covers the follow-up that tracks whether recommendations were carried out, verifying the effectiveness of remediation (confirming the effect, not merely formal completion), the principle of confirming even in follow-up with objective evidence (not taking oral answers at face value), and audit quality management (review of working papers, supervision, internal evaluation) that keeps the quality of the audit work itself.
An audit does not end with issuing the report. Only when it includes the follow-up that confirms whether the recommended improvement was actually carried out and the targeted risk was reduced is the audit complete. A systems auditor must judge how to confirm the remediation status with objective evidence rather than taking oral answers or a "done" report at face value, and verify whether the fix is effective (effectiveness), not merely formal. Furthermore, to keep the quality of the audit itself, internal quality management that reviews and supervises whether the working papers and conclusions are appropriate is indispensable—because if the auditor's judgment is wrong, trust in the whole audit is shaken.
6.3.1Follow-up and verifying the effectiveness of remediation
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.