Findings from the payments audit are either remediated or formally risk-accepted. What should Internal Audit do to finish the engagement?
Select an answer to reveal the explanation.
Short Explanation
Closing an engagement is like signing off a building inspection once every punch-list item is fixed or formally waived. Verify remediation or accepted risk, then close. Leaving it open forever or shredding the papers isn’t closure.
Full Explanation
After payments-audit findings are remediated or formally risk-accepted, Internal Audit should close the engagement after verifying remediation or accepted risk. Closure is a controlled end state: punch-list complete or formally waived, evidence retained. Civic audit quality depends on verification before close—not indefinite open engagements or shredded papers.
Leaving the engagement open indefinitely so new findings accumulate forever prevents clean reporting periods and accountability. Transferring ownership of the audit engagement record to control owners permanently collapses third-line custody of the engagement. Deleting all working papers upon first management response destroys evidence needed for follow-up and external review.
Exam caveat: verify remediation/acceptance, then close; retain working papers per retention policy.
Operational check: for each finding, confirm remediated evidence or approved acceptance; CAE/audit manager approval to close; lock engagement per procedure; ensure working papers remain accessible under retention—never deleted at first response.
Closure checklists should require verified remediation evidence or documented risk acceptance with approver identity before the engagement status flips to Closed. Retain working papers per municipal retention schedules and prohibit transfer of engagement ownership to control owners as a shortcut to closure.