Who should plan the audit engagement versus who should own remediation of control gaps found?
Select an answer to reveal the explanation.
Short Explanation
The inspector writes the inspection plan; the building owner still fixes the boiler. Audit managers plan engagements; control owners remediate. If one person does both ends, independence and accountability melt together.
Full Explanation
Audit managers plan engagements; control owners retain remediation ownership—roles must not collapse. The inspector plans the inspection; the building owner still fixes the boiler. Civic IRM keeps planning and remediation accountabilities distinct so independence and operational ownership both survive.
Control owners planning the engagement and also closing findings without auditor review erase third-line control of the engagement. The GRC admin personally remediating every finding to preserve independence confuses platform administration with control ownership. Auditors implementing technical control fixes so ownership stays inside Audit pull the third line into first-line build work.
Exam caveat: plan ≠ remediate. Audit plans; control owners fix; GRC admins configure; auditors should not become implementers by default.
Operational check: verify engagement plan owned by audit management; findings assign remediation to control owners; audit verifies closure evidence; remove any SOP that assigns technical fix implementation to auditors as standard.
RACI charts for engagements should list audit manager as Responsible for planning, control owners as Responsible for remediation, and auditors as Accountable for verifying closure evidence. Escalate any SOP that assigns fix implementation to auditors as a segregation defect.