# Audit Follow-Up and Verification Standards Reference

## Primary Frameworks

### IIA International Standards for the Professional Practice of Internal Auditing
- **Standard 2500**: Monitoring Progress — The chief audit executive must establish and maintain a system to monitor the disposition of results communicated to management
- **Standard 2500.A1**: The chief audit executive must establish a follow-up process to monitor and ensure that management actions have been effectively implemented or that senior management has accepted the risk of not taking action
- **Standard 2600**: Communicating the Acceptance of Risks — When the chief audit executive concludes that management has accepted a level of risk that may be unacceptable to the organization, the matter must be discussed with senior management and potentially reported to the board
- **Application**: Establishes the mandatory requirements for follow-up processes and risk acceptance escalation

### ISO 19011:2018 — Guidelines for Auditing Management Systems
- **Section 6.7**: Completing the audit — includes provisions for follow-up actions and verification
- **Section 6.6.1**: Audit report content shall include follow-up action plan if applicable
- **Application**: Provides the internationally recognized guidance for post-audit follow-up in management system contexts

### GDPR Article 5(2) — Accountability Principle
- The accountability principle requires controllers to demonstrate ongoing compliance, not merely point-in-time compliance
- Unresolved audit findings represent a failure to implement and maintain appropriate measures
- Follow-up verification operationalizes the continuous compliance obligation under GDPR

### GDPR Article 39(1)(b) — DPO Monitoring Compliance
- The DPO shall monitor compliance with GDPR and the controller's policies, including the assignment of responsibilities and the training of staff involved in processing operations
- Audit follow-up is a key mechanism through which the DPO fulfills this monitoring duty

## Verification-Specific Standards

### ISACA IT Audit and Assurance Standards
- **Standard 1402**: Follow-Up Activities — IS audit and assurance professionals shall monitor the disposition of reported findings and recommendations
- **Application**: Specific guidance for technology-related finding follow-up in privacy system audits

### ISO 27001:2022 — Information Security Management Systems
- **Clause 10.1**: Nonconformity and corrective action — the organization shall evaluate the need for action to eliminate the causes of the nonconformity and verify effectiveness of corrective actions taken
- **Clause 10.2**: Continual improvement — the organization shall continually improve the suitability, adequacy and effectiveness of the ISMS
- **Application**: Provides the corrective action verification framework applicable to privacy management systems

### NIST SP 800-53 Rev. 5 — CA-5 Plan of Action and Milestones
- Organizations shall develop, maintain, and update plans of action and milestones for documenting remedial actions to address weaknesses found during assessments
- **Application**: Provides a structured model for tracking and verifying remediation milestones

## Related Frameworks
- ISO 27701:2019 Section 6.15.2: Independent review of information security adapted for privacy management
- COBIT 2019 MEA02.04: Report deficiencies — monitor corrective actions until closed
- SOC 2 Type II: Monitoring of control exceptions over the examination period
- AICPA Guide: Reporting on Controls at a Service Organization (remediation evidence requirements)

## Key Publications
- IIA Practice Guide: Following Up on Reported Observations and Recommendations
- ISACA COBIT 2019: MEA02 — Monitor, Evaluate and Assess the System of Internal Control
- ISO 19011:2018: Guidelines for auditing management systems (Section 6.7 follow-up guidance)
- NIST SP 800-53A Rev. 5: Assessing Security and Privacy Controls (ongoing assessment procedures)