Once the report has been approved and circulated to concerned/responsible persons, there is need to follow up and track implementation of the recommendations by the audit team to ensure full compliance. Depending on if the responsibility was assigned to internal audit department in its charter, the audit team initiate a follow up process or audit to confirm that noted control weakness and non-conformities are being corrected within the timeline agreed with the auditee and stipulated in the report. The auditee reports on the status of each of the audit findings and what has been done to remediate the gaps. Where controls implemented did not completely address the issues, the auditee shall explore other means or compensatory controls to close the gaps. However, if the control weakness or non-conformity could not be remediated or is impracticable to do so, management approval to accept the inability to implement controls that will fully remediate the issue as residual risk shall be obtained and documented.
The follow up process shall run its course until all noted gaps and non-conformities have been full remediated and compliance certificate issued to affirm conformance.