PM 2500 : The CAE must establish and maintain a system to monitor the disposition of results communicated to management included
1) Time Frame for management’s response
2) Evaluation and verification of the response
3) Follow Up
4) Communications process that reports unsatisfactory responses
The IA is the best position to carry out the Follow Up responsibility because
1) better acquainted the facts than the SM or others control centers in the organization and
2) More objective than operating manager who must take the corrective action.
PM2600 : Acceptance of Excessive Risk
# unacceptable risk
# present to the SM
# communicate to the Board