Which of the following statements best describes an internal audit function’s responsibility for assurance engagement follow-up activities?
a. The internal audit function should determine that corrective action has been taken and is achieving the desired results, or that senior management has assumed the risk associated with not taking corrective action on reported observations.
b. The internal audit function should determine whether management has initiated corrective action but has no responsibility to determine whether the corrective action is achieving the desired results. That determination is management’s responsibility.
c. The CAE is responsible for scheduling audit follow-up activities only if asked to do so by senior management or the audit committee. Otherwise, such activities are discretionary.
d. Audit follow-up activities are not necessary if the auditee has agreed in writing to implement the internal audit function’s recommendations.