QR Ltd., a listed company, has appointed CA Suba as its Chief Internal Auditor, and she is continuing in this role for the third consecutive year.…

(1) As per SIA 390 Monitoring and Reporting of Prior Audit Issues, the Chief Internal Auditor CA Suba is responsible for continuously monitoring the closure of prior audit issues through timely implementation of action plans included in past audits. This shall be done with a formal monitoring process, elements of which are pre-agreed with management and those charged with governance. The responsibility to implement the action plans remains with the management. In monitoring and reporting of prior audit issues, the responsibility of the Internal Auditor is usually in the form of an "Action Taken Report (ATR) of previous audits". The internal auditor should review whether follow-up action is taken by the management on the basis of his report. If no action is taken within a reasonable time, he should draw the management's attention to it. Where the management has not acted upon his suggestions or not implemented his recommendations, the internal auditor should ascertain the reasons thereof. Where the management has accepted his recommendations and initiated the necessary action, the internal auditor should periodically review the manner and the extent of implementation of the recommendations and report to the management, highlighting the recommendations which have not been implemented fully or partly. In the given situation, CA Suba is responsible not only for reporting internal control weaknesses but also for following up on the status of corrective actions taken by management. Since the deficiencies relating to segregation of duties, vendor reconciliations, and IT access controls were repeatedly reported in earlier internal audit reports and still remain unresolved, she should evaluate the adequacy and effectiveness of management's corrective measures, assess the risk arising from continued non-compliance, and communicate the status of unresolved issues to the Audit Committee. She should also highlight delays or failure by management in implementing recommendations and assess whether the recurring weaknesses increase the risk of fraud, errors, or control failures within the organization. (2) In the given situation, the most appropriate report to be submitted is a Follow-up Internal Audit Report / Action Taken Report (ATR) to the Audit Committee with the status of corrective actions taken by management on previously reported observations. Action Taken Report may include the following: (i) Reference to the previous audit reporting containing the reported issues. (ii) Implementation Action agreed by the management along with target implementation date. (iii) Status of action taken by management. The same may be classified under Implemented/ Not Implemented. (iv) Residual risk and rating for any unimplemented action. (v) Audit findings not implemented for long period of time. (vi) Any critical audit finding that requires immediate action for action or implementation.