Last updated:
CISA preparation guide
What does the auditor do at follow-up in a CISA question?
At follow-up, the auditor checks that management did what it agreed in response to the findings, or that it formally accepted the risk at the right level. Three traps sit around that answer: re-running the whole audit, fixing the issue yourself, and closing the finding because management says it is done. The right option tests the agreed action and escalates an accepted risk that the auditor thinks is too high.
Follow-up is the last step of the audit sequence on the CISA cheat sheet, and it is where questions test whether you keep the auditor’s role to the end.
This is independent CertArc teaching material.
Start CISA baselineFollow-up: the right move and the trap
| Situation at follow-up | The auditor’s move | The trap |
|---|---|---|
| Management says the fix is in place | Test the agreed action, on a sample if needed | Closing the finding on management’s word |
| The fix differs from what was agreed | Judge whether it still addresses the risk | Insisting on the original wording |
| Management decided not to fix it | Confirm the acceptance is formal and made at the right level | Reporting it as overdue |
| The accepted risk looks too high to the auditor | Raise it with senior management or the audit committee | Overruling management, or staying silent |
| The fix is not finished by the agreed date | Report the status and the remaining exposure | Implementing it for them |
Original teaching example
Six months after an audit, the IT manager tells the auditor that the finding on shared administrator accounts is resolved, because named accounts were created for each administrator.
Creating named accounts is half the fix. The risk was that actions could not be traced to a person, so the auditor checks that the shared accounts were disabled or locked down, and that admin activity now logs under the named accounts. If the shared accounts still work, the finding stays open. The auditor reports it; it is not the auditor’s job to disable them.
What follow-up verifies
Follow-up has a narrow scope: the agreed actions and the risks they addressed. It is not a new audit. Testing is proportionate: enough evidence to show the action works, focused on the risk the finding described.
Risk acceptance is a management decision
Management may decide that a fix costs more than the risk it removes. That is a legitimate choice, if it is documented and made by someone with authority for that level of risk. The auditor checks those two things.
Escalation is for the case where the auditor believes the accepted risk exceeds what the organisation would tolerate. It goes to senior management or the audit committee, not into a stronger recommendation.
Where candidates lose the point
Three options tempt candidates. “Re-perform the full audit” sounds thorough, but it is out of scope. “Implement the fix” sounds helpful, but it impairs the auditor’s independence. “Close the finding” sounds efficient, but it relies on assertion. The answer that verifies, and escalates when needed, is almost always the one ISACA’s role model supports.
Frequently asked questions
Who decides whether a finding can be closed?
The auditor decides whether the evidence supports closing it. Management decides what action to take or whether to accept the risk.
Should follow-up re-test everything in the original scope?
No. It tests the agreed actions and the risks they address.
Sources and limits
Exam scope and weights: ISACA CISA exam content outline. Certification eligibility: ISACA certification requirements. Checked 27 October 2026.
Study methods and examples are independent CertArc teaching guidance. Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
