Once an observation is identified, there are several steps the internal audit function must go through to:

		do nothing
		determine what impact, if any, the observation has on the internal audit functions evaluation of whether the related controls are designed adequately and operating effectively
		Immediately communicate to the CAE and audit committee
		flag the issue as a potential fraud