A report on the status of follow-up activities, including agreed-upon recommendations not implemented, should be presented to the audit committee, if one has been established, or alternatively to the most appropriate management level of the entity. Preceding IT audit follow-up report preparation, where management provides information on actions taken to implement recommendations, and the IT auditor has doubts about the information provided, appropriate testing or other procedures should be undertaken to ascertain the true position or status — prior to concluding follow-up activities.
“View Part I of the IT Audit Follow-up: Assessing Recommendation Resolution series here“
