Division 6.3 Follow-up of Audit Outcome

Where appropriate, an action plan should be drawn up and delivered by the auditee. It should propose time-bound corrective and preventive action to address any weakness identified by the audit or audit programme. The audit team should assess the suitability of the action plan and may be involved in verifying its subsequent implementation:

• an Action plan enables the audit team to assess whether the proposed corrective and preventive action is sufficient to address the recommendations of the audit report. Action plans should include risk-based prioritisation and time frames for completion of corrective and preventive action. A wide range of different action plans could be considered satisfactory. It is for the auditee to choose from the various options available,

• Corrective and preventive action should not be confined to addressing specific technical requirements but should, where appropriate, include system-wide measures (for example communication, cooperation, coordination, reviewing and streamlining of control processes, and so forth). A root cause analysis of any non-compliance should be conducted by the auditee in order to determine the most appropriate corrective and preventive action. Any differences of opinion between the auditee and audit team should be resolved,

• Close-out: Mechanisms should be established to ensure that action plans are appropriate and that corrective and preventive actions are effectively completed in a timely manner. Procedures for verifying the close out of the action plan should be agreed between the auditee and the audit team.