audit-follow-up-verify

Audit Follow-Up and Verification

Overview

Audit follow-up is the process by which the audit function monitors and verifies that management has effectively implemented remediation actions in response to audit findings. IIA Standard 2500 requires the Chief Audit Executive to establish and maintain a system to monitor the disposition of results communicated to management. Follow-up is not merely tracking whether actions were completed — it requires independent verification that the remediation actually addresses the root cause and reduces the identified risk to an acceptable level.

In privacy audits, effective follow-up is critical because unremediated findings represent ongoing regulatory non-compliance. A GDPR Art. 5(2) accountability failure, an unpatched consent mechanism, or a persistent DSAR processing delay exposes the organization to supervisory authority enforcement, data subject complaints, and reputational harm.

Follow-Up Scheduling

Follow-up timing is driven by finding severity:

Severity	Initial Follow-Up	Re-test if Partial	Maximum Extensions
Critical	30 days after target date	15 days	1 (requires CPO approval)
High	60 days after target date	30 days	2 (requires DPO approval)
Medium	90 days after target date	45 days	2
Low	180 days after target date	90 days	3
Advisory	Next scheduled audit	N/A	N/A

Verification Testing Methods

Re-Performance

The auditor independently repeats the control activity to verify it produces the expected result. Used for procedural controls (e.g., re-performing a DSAR response to verify the process meets the 30-day deadline).

Inspection

The auditor examines records, documents, or system configurations produced after remediation to verify the control is operating as designed. Used for documentary controls (e.g., inspecting updated DPAs for Art. 28 compliance).

Observation

The auditor observes the remediated process in real-time to verify it functions correctly. Used for operational controls (e.g., observing the updated breach notification workflow during a tabletop exercise).

Inquiry and Corroboration

The auditor interviews process owners about the remediated control and corroborates statements with independent evidence. Used when direct testing is impractical.

Data Analytics

The auditor analyzes post-remediation data to verify the control is producing expected outcomes. Used for measurable controls (e.g., analyzing DSAR response times post-remediation to verify improvement).

Closure Criteria

A finding may be closed only when ALL of the following are satisfied:

1. Remediation actions completed: All planned actions documented as complete by the Remediation Owner
2. Evidence provided: Remediation Owner provides documentary evidence of completion
3. Independent verification: Verification Owner (auditor or independent party) confirms effectiveness through testing
4. Root cause addressed: Verification confirms the underlying root cause is resolved, not just the symptom
5. Sustainable: The fix is embedded in ongoing processes (not a one-time manual correction)
6. Documented: Working papers document the verification procedure, evidence reviewed, and conclusion

Finding Status Lifecycle

New → In Progress → Remediation Complete → Pending Verification → Closed
                                                    ↓
                                              Partial Pass → Re-remediation → Pending Verification
                                                    ↓
                                                  Fail → Reopened → Escalation

Escalation for Unremediated Findings

Trigger	Escalation Level	Action
Finding overdue 30+ days (Critical)	CPO and CISO	Mandatory management meeting within 5 days
Finding overdue 45+ days (High)	Audit Committee	Report to next Audit Committee meeting
Finding failed verification twice	DPO and CPO	Root cause review and revised plan required
Finding open 12+ months (any severity)	Board Audit Committee	Include in annual audit opinion
Repeated finding (same root cause, 3+ occurrences)	Audit Committee	Systemic issue investigation

Reporting

Individual Finding Follow-Up Report

Produced for each verification event: finding reference, verification method, evidence reviewed, test results, conclusion (pass/partial/fail), and recommended next steps.

Periodic Follow-Up Summary

Monthly report to DPO and CPO summarizing: total open findings by severity, overdue findings, findings closed in period, verification pass rate, aging analysis, and escalation status.

Annual Audit Opinion Impact

Unremediated findings at year-end are factored into the annual audit opinion. Persistent critical or high findings may result in an "Unsatisfactory" or "Needs Improvement" rating.

Integration Points

• audit-remediation-program: Follow-up verifies the effectiveness of remediation managed by the remediation program
• audit-evidence-collect: Follow-up requires fresh evidence collection using the same quality standards
• audit-report-writing: Follow-up results feed into periodic and annual audit reports
• records-of-processing: Follow-up may verify corrections to ROPA entries