An internal-control review mandate is an agreed scope connecting institutional risks to review work, remediation responsibilities and acceptance evidence.
The commissioning decision should specify what the reviewer will assess and what management will implement. Define access, evidence, deliverables and safeguards before work begins, with separate responsibility for any subsequent independent assurance.
Establishing the risk-based scope and assessing design versus operation
The operation of internal control systems is the responsibility of the relevant line managers.
— National Treasury Internal Audit Framework2009, section1.3.2.5, page8
Commissioning an internal-control review requires establishing a risk-based scope that focuses review efforts on high-exposure operational processes. Governing bodies and executive management must define engagement objectives that align with organisational risks, statutory obligations, and operational priorities.
The review scope must explicitly distinguish between evaluating control design adequacy and assessing actual operating effectiveness. Design adequacy evaluates whether a control—as conceptualised—is logically capable of mitigating targeted risks.
Operating effectiveness examines whether the control functions as intended in daily practice. A process should not be automatically classified as a control failure simply because a written policy is absent or automated workflow controls are missing.
A review should evaluate the evidence for informal or manual controls rather than assume failure. A separate requirement for a documented policy may still apply and must be assessed on its own terms. Defining scope boundaries ensures that review procedures focus on genuine risk exposures rather than superficial administrative gaps.
Securing evidence access and preserving management ownership
Executing a comprehensive control review requires agreed access to relevant records, personnel and systems, with lawful confidentiality, security and privacy arrangements. Internal audit's mandate and any access restriction should be addressed through its applicable charter and escalation routes. Scope limitations or restricted data access must be addressed promptly with management to prevent compromised review conclusions.
Throughout the review and remediation support engagement, operational management retains primary ownership and responsibility for internal controls. Under Standard 9.1, internal audit seeks to understand governance, risk management, and control processes to inform audit strategy and plans.
Internal auditors and advisory reviewers do not serve as management's design authority or assume operational responsibility for control execution. Management must approve and implement control enhancements, ensuring that administrative accountability remains with operational leadership.
Preserving management ownership prevents line managers from abdicating control responsibilities to external advisors or internal audit functions. This separation reinforces long-term institutional accountability.
Implementing conflict-of-interest safeguards and protecting objectivity
When internal audit functions or external service providers deliver control-review or remediation advisory support, robust safeguards must protect professional objectivity. Standard2.2 presumes objectivity impaired where an internal auditor provides assurance over an activity for which that auditor had responsibility in the preceding twelve months. Apply the rule to its stated scope; do not treat every previous advisory engagement as automatically prohibited.
Where an internal audit function provides advisory services related to control remediation, the chief audit executive must establish safeguards before subsequent assurance engagements are conducted over those same activities. Safeguards include assigning different personnel to subsequent assurance reviews or engaging independent external providers.
Differentiating mandatory requirements from advisory implementation guidance is essential when establishing these safeguards. Under the Global Internal Audit Standards, issued in January 2024 and effective from January 2025, mandatory practices use the term "must" to specify unconditional obligations.
In contrast, non-mandatory considerations use "should" or "may" to present preferred or optional implementation practices. The National Treasury Internal Audit Framework Revised 2009 provides dated historical public sector context regarding objectivity under the PFMA and MFMA.
Defining usable deliverables, practical acceptance, and handover
To deliver actionable value, control-review engagements must produce structured deliverables that guide management remediation efforts. Reviewers collaborate with management to establish agreed-upon action plans that address root causes and mitigate identified risks.
Key practical deliverables and handover protocols should include several core components:
- Detailed gap analysis reports comparing observed operational conditions against established evaluation criteria.
- Remediation roadmaps specifying corrective action steps, designated operational owners, and target implementation dates.
- Management acceptance protocols confirming that operational leadership agrees with identified findings and assumes responsibility for remediation execution.
- Structured handover debriefs transferring review findings and action plans to line management for implementation.
Formal acceptance ensures that management endorses the feasibility of proposed corrective actions before implementation begins. The handover process transitions the engagement from review support to active management execution.
Executing independent follow-up verification and scoping matrix
Following the handover of remediation deliverables, internal audit performs independent follow-up assessments to confirm that management has implemented agreed-upon action plans. Follow-up verification must be distinguished from initial framework design or routine workpaper testing.
Internal audit uses a risk-based approach to determine the extent of follow-up testing required, evaluating whether implemented actions have effectively resolved the underlying root causes. Follow-up procedures include inquiring about progress, examining physical evidence, and re-testing controls where risk significance warrants re-examination.
Internal audit records its follow-up assessment, unresolved actions, supporting evidence and relevant management explanations in its tracking system. If management fails to progress on corrective actions, the chief audit executive documents the explanation and evaluates whether unmitigated risks exceed organisational tolerance.
The four-column matrix below outlines a qualitative scope crosswalk, mapping review objectives against deliverables, management ownership, and acceptance criteria.
| Review Scope Objective | Engagement Deliverable Output | Accountable Management Owner | Practical Acceptance & Handover Criteria |
|---|---|---|---|
| Evaluate design adequacy and operating effectiveness of supply chain controls. | Comprehensive gap analysis report detailing control criteria, observed conditions, and root causes. | Supply Chain Executive & Procurement Manager | Formal management sign-off acknowledging finding accuracy and agreeing to proposed criteria. |
| Develop remediation roadmap for financial reconciliation procedures. | Action plan matrix specifying corrective steps, implementation milestones, and resource needs. | Chief Financial Officer & Finance Manager | Executive approval of remediation timelines and resource allocations. |
| Review IT user access management and segregation of duties. | Technical advisory memo outlining access control gaps and recommended role definitions. | IT Steering Committee & Information Security Officer | Approval of revised user access matrix and commitment to role-based system updates. |
| Conduct independent follow-up verification on resolved audit findings. | Remediation tracking update report and independent verification summary. | Management action owner; internal audit verifies independently | Evidence-based follow-up and reporting to the responsible oversight body; do not assign control operation to auditors. |
Sources
- Historical Treasury guidance, second edition March2009 — National Treasury
- IIA2024 standards issued2024-01-09 effective2025-01-09 — Institute of Internal Auditors
Frequently Asked Questions
Does a missing formal policy automatically signify an internal control failure?
No, a missing policy does not automatically constitute a control failure. Evaluate whether the control operates effectively and whether the institution separately has a binding requirement to document the policy. Those are related but distinct findings.
How does Standard 9.1 frame internal audit's role regarding control processes?
Standard 9.1 requires the chief audit executive to understand the organisation's governance, risk management, and control processes to inform internal audit strategy and plan development, rather than acting as management's control design authority.
Who holds primary responsibility for designing and implementing control remediation actions?
Operational management holds primary ownership for designing, implementing, and operating internal controls. Internal audit provides advice and independent evaluation but cannot assume management execution duties.
How do the 2024 Global Internal Audit Standards approach advisory safeguards compared to 2009 Treasury guidance?
The 2024 Standards establish current, mandatory requirements under Standard 2.2 requiring specific safeguards when providing assurance over areas where advisory services were provided, whereas the 2009 Treasury Framework provides historical public sector context under the PFMA.
What steps are required during independent follow-up verification of remediation action plans?
Standard 15.2 requires internal auditors to follow an established methodology that includes inquiring about progress, conducting risk-based follow-up assessments, examining evidence, and updating tracking systems to confirm risk mitigation.
For wider context, read the internal control design and testing overview.