Following the exit conference, the audit team provides management with the revised draft report to collect their formal Management Responses. Management must respond in writing within a set corporate timeline (typically 10 business days).
Management Response Requirements = Action Strategy + Named Process Owner + Target Completion Date

A compliant management response must explicitly document three core elements:
  1. Action Plan Strategy: A detailed description of the specific process modifications, system configurations, or policy revisions that management will implement to resolve the root cause of the audit finding.
  2. Named Process Owner Assignment: The exact name and corporate title of the individual manager who accepts personal accountability for executing the remediation plan.
  3. Target Completion Date (TCD): A specific, realistic deadline determined by the risk severity of the finding (e.g., 30 days for high-severity findings, 90 days for moderate control gaps).

The audit team evaluates the proposed response to confirm it matches the risk exposure. If the management action plan does not adequately address the root cause of the vulnerability, the CAE must return the response to management for revision before publishing the final report.
 
PreviousNext