We currently have an external company doing out IT audit due to its complexity. When the bank recieves this report, what should my role be? Do I need to make sure the external company's reccomendations are being followed or is that out of the scope of my responsibilities? Any information as to my role as an internal auditor would be greatly appreciated. We currently have no procedures that cover this and I have been receiving conflicting responses from management. Thanks.

Generally Internal Audit reviews the report to make sure it agrees with the scope requested. You might also review the workpapers to ensure that they agree with the report. Internal audit does then follow up to make sure all recommendations are addressed just as with an audit you did yourself.

Thanks for clearing this up!

Internal audit should also review the findings and recommendations to make sure they are reasonable. You should help the auditee to make sure they present all the relevant information so that the report doesnt contain a bunch of findings that are not correct or only half true, and recommendations that are reasonable to address the concern. External auditors have their place, but they often miss...

Our examiners have stated I am required to perform follow-ups on all external audits.

In banks I have worked at, the IA would not get involved with disputed findings. The person responsible for IT, GLBA, Vendor Mgmt, BCP etc would dispute the findings as they are most knowledgeable in those areas. I agree IA would make sure any findings were acted upon and resolved and follow up.