Which of the following statements best describes the internal audit function’s responsibility for follow-up activities related to a previous engagement?
a. Internal auditors should determine if corrective action has been taken and is achieving the desired results or if management has assumed the risk of not taking the corrective action.
b. Internal auditors should determine if management has initiated corrective action, but they have no responsibility to determine if the action is achieving the desired results. That determination is management’s responsibility.
c. The CAE is responsible for scheduling follow-up activities only if directed to do so by senior management or the audit committee. Otherwise, follow-up is entirely discretionary.
d. None of the above.