I am the first internal auditor our institution has had and I'm learning as I go. What do you do when management responds to one of your recommendations and still did not address the actual problem? Do you bring it up again in the next audit?

The audit committee should be made aware of the situation. Be sure to document in the minutes. If the problem affected several accounts or a procedures, I'd likely mention it in the report again.

My audit committee would probably not approve the response and have me relay to management what they would like to see changed. Then I would report back to the committee at the next meeting whether management made the appropriate changes. If management did not respond properly, I would either have another audit committee meeting, or have the uncooperative officer meet with the higher-ups to hash it out, then I would report the outcome to the committee.

If I felt strongly about the control issues that weren't being addressed, I would repeat the finding. I would also ensure that the response clearly articulated why management believes the risk is worth taking. That way the audit committee has all the relavent information and can provide additional guidance at that point. Before the report with the response is issued, IA and management will have fully discussed the comments/responses.

Do you do a follow-up review after an appropriate time period? We usually do a follow-up 30 days after getting management response to an audit. This way you can report what was actually done in response to the report, and address the problem and make additional recommendations if necessary. The original audit report as well as the follow-up will go to the dept head and Audit Committee.

I would contact management and reclarify the issue and try to get a response that addresses the actual finding. Management may just not realize that they didn't address the actual issue.

I would agree with DogLover - solve the problem before it even gets into the final audit report - which will be before the audit committee gets it - sometimes it's just a communication thing. I usually talk to management as soon as I read their response so that we can come to an agreement and enter the proper information into the report - I would never issue an audit report if I knew it would only make me look like a fool for not getting a proper response to the recommendation made.