# Audit Remediation Program Standards Reference

## Primary Frameworks

### IIA International Standards for the Professional Practice of Internal Auditing
- **Standard 2500**: Monitoring Progress — Chief Audit Executive shall establish and maintain a system to monitor the disposition of results communicated to management
- **Standard 2500.A1**: The chief audit executive shall establish a follow-up process to monitor and ensure that management actions have been effectively implemented
- **Application**: Establishes mandatory requirement for finding follow-up and remediation monitoring

### ISO 19011:2018 — Guidelines for Auditing Management Systems
- **Section 6.6**: Preparing and distributing the audit report
- **Section 6.7**: Completing the audit (includes follow-up)
- **Application**: Provides guidance on post-audit finding management

### GDPR Accountability (Art. 5(2))
- Remediation of audit findings is a core component of demonstrating GDPR accountability
- Persistent unremediated findings indicate failure to implement appropriate measures per Art. 24

## Finding Classification Standards

### IIA Practice Guide: Audit Opinions
- **Criteria**: Overall audit ratings based on finding severity and distribution
- **Ratings**: Satisfactory, Needs Improvement, Unsatisfactory (terminology varies by organization)

### NIST SP 800-53 Rev. 5 — CA-5 Plan of Action and Milestones
- **Requirement**: Organizations develop, maintain, and update plans of action and milestones
- **Application**: Provides model for tracking remediation actions with milestones

## Related Frameworks
- COBIT 2019: MEA (Monitor, Evaluate, and Assess) domain
- ISO 27001:2022 Clause 10.1: Nonconformity and corrective action
- SOC 2 Exception Management (AICPA guidance)

## Key Publications
- IIA Practice Guide: Following Up on Reported Observations and Recommendations
- ISACA COBIT 2019: Monitoring, Evaluation and Assessment
- ISO 27001:2022 Clause 10: Improvement (corrective action requirements)