Responses and retests

A Control Owner prepares a corrective response with a response date and evidence explaining the action taken or planned. Link the response to the finding or engagement it addresses, and check the business unit and audited entity where applicable. The next reviewer should be able to open the response and understand the issue without matching similar descriptions by hand.

The management response action releases a Scheduled corrective action and records the operation result. The Audit Manager decides whether the prepared response is ready for release. Follow-up testing then records evidence and sample size against the finding and control. The Independent Assurance Reviewer uses that material to explain a judgment about the response and the work examined.

• Response preparation. The Control Owner records the explanation and response date while the corrective action is Scheduled. The finding or engagement link identifies the work that prompted the response.
• Release decision. The Audit Manager checks the prepared evidence and authorizes release. After the action, inspect the Released state together with its operation receipt.
• Retest workpaper. The Independent Assurance Reviewer records the sample and evidence against the finding and control. A review decision preserves the reasoning about the related finding or corrective action.

Agree who prepares responses and who may authorize release. Decide what the evidence must contain before the Audit Manager acts. A response saying access fixed should explain what changed and where the reviewer can inspect the support. If another system performs the operational change, agree how its reference will be captured in the response.

Define the follow-up review procedure and how the reviewer records an inconclusive result. Decide how Released responses are examined before any later move to Reconciled. Keep the release decision and the later evidence review clear to the team. Configure role access for the Independent Assurance Reviewer and rehearse that person’s access to the referenced evidence location before assigning follow-up work.

Take an approved finding about supplier access. The Control Owner prepares a Scheduled response explaining the access change and includes a reference to the supporting record. The Audit Manager checks the finding link and response date, then authorizes release. Inspect the resulting receipt and confirm that the corrective action is Released.

The Independent Assurance Reviewer then examines a fresh sample of access changes and records the evidence against the finding and control. Ask the reviewer to explain whether that sample supports the response. Record the judgment and reason against the relevant finding or corrective action. If the evidence is inconclusive, retain that explanation and agree the next work before changing another record’s state.

• Scheduled Responses — Inspect prepared responses before release.
• Responses Awaiting Reconciliation — Follow Released responses awaiting further review.
• Retest Workpapers — Read follow-up evidence for workpapers with a recorded positive sample size.

Use corrective response and retest and investigate uncertain outcomes through evidence and exception review.