6

Escalation Procedure
KEy Points

Escalation processes may result from (1) a red traic light status in the overall
audit statement, (2) the fact that recommendations have not been implemented,
or (3) from a disagreement about some of the audit indings or recommendations.
During escalation, all responsible parties, including the Board, are informed
directly.
he overall audit statement for a basic audit is primarily intended to assess the
quality of the indings, but the overall follow-up rating looks mainly at the effectiveness of the implementation process.
If there is any disagreement, the audit team, the audit lead, and/or the Audit
Manager should attempt to de-escalate the situation or reach a consensus with
the auditee without varying the original audit inding.
However, if the disagreement persists, a management disagreed classiication
is added to the audit report and the Board summary.
Audit Procedure

need for Escalation

Escalation According
to Classiication

Internal Audit should ensure that the actual execution of audits is done in a manner
that is agreeable to everyone involved. To ensure such agreement, audit results
should never be used for anything other than the intended purpose, as required by
the standards and codes of conduct of the international audit institutes. Relations
between Internal Audit and auditees should always be based on a transparent and
professional audit, rather than on possible consequences of an audit, because this
could have a negative impact on long-term cooperation and trust.
Nevertheless, audit work may sometimes give rise to situations that require
special notiication of all those responsible, including the Board. his form of
reporting exists outside the normal reporting system and depends on the particular
situation. It is known as escalation, because it is used to make those responsible
aware of problem situations in a clear and unmistakable manner. he objective is to
identify problem focused solutions quickly and to implement them efectively.
Escalation should not be interpreted as a penalty, but as a way of getting to the
necessary solutions quickly and securely in order to ensure a smooth audit and to
maintain the interests of the auditees and their organizations.
During the escalation process, the classiication of audit indings into locally,
regionally, or Board-relevant has to be observed in all instances. If audit indings
classiied as local are escalated, the auditors must decide whether such indings
should be reported directly to the Board. he auditors should irst attempt to resolve the matter with regional management, but if agreement cannot be reached,
the auditors should change the classiication and report the case to the Board. For
signiicant audit indings, the classiication is immediately set to Board-relevant.

502

Special Topics and Supplementary Discussion

Escalation Procedure

If a inding is serious and Board-relevant, the auditors can also inform the Board
immediately through a priority Board issue (see Section B, Chapter 5.2.5), asking
the Board to take a decision or to intervene.
Escalation should always take the issue to the next higher level of the hierarchy,
the audit lead escalating to the Audit Manager, who in turn escalates to the CAE,
who ultimately informs the Board.
In general, Internal Audit distinguishes between three diferent scenarios that
can trigger an escalation process:
escalation due to an inadequate overall audit statement (red traic light; see Section D, Chapter 7.2.1),
escalation because recommendations have not been implemented (follow-up),
and
escalation because management does not agree with certain indings
If an audit is escalated, the sub-phases of the follow-up phase must be executed in
a shorter time frame (see Section B, Chapter 6.1).
At GIAS, the escalation procedure for audits identiies two escalation stages. he
chart below shows when escalation stages I or/and II are initiated. he actions that
are performed during an escalation process are explained in more detail in the following.

Status
Report Type

Overall Audit
Statement/Scoring

Escalation Stage I Escalation Stage II

Management
Disagreed

Escalation
Process

R
Basic

Follow-up I

Follow-up II

Na

Na

Na

Na

Na

Xa)

Na

X1)

X2)

Na

Na

X1)

X2)

Fig. 17 Escalation Process

503

D | 6

Escalation Hierarchy

scenarios for an
Escalation Process

Escalation stages

Criteria for Escalation

Processes

he GIAS escalation procedure is characterized by a number of criteria:

he CEO must be informed, either at a personal ad-hoc meeting with Internal
Audit and/or with an e-mail sent by the Audit Manager or the CAE.
he CEO will ask the management in charge to ensure an adequate sequence of
actions regarding the unresolved items.
If other Board responsibilities or business units are afected, the Board member
in charge of the operational area must be involved in the discussion of the problem.
he regional and/or local manager proposes an action list, including timelines,
for eliminating the problems.
During the follow-up phase, the auditees must provide clear evidence of the
results and actions taken.
Every quarter, GIAS prepares the GIAS escalation report and distributes it to the
Board.

Red overall Audit

statement traic Light

he following applies to the escalation scenarios related to the overall audit statement:
he overall audit statement is always considered inadequate if the rating was
weak or substantial weakness (see Section D, Chapter 7.2.1). Such a rating
directly leads to a red traic light status. Once the overall audit statement has
been issued, the relevant sections of the management and Board summaries are
updated.
hese reports are forwarded directly to the regional and local heads of the
inance unit, regional and local risk management, and the corporate departments.
hese parties are then directly involved in the indings identiied as R (relevant to
regional/senior management) or B (Board relevant) by way of a joint implementation process and an immediate examination of the results by Internal Audit.

Follow-Up scoring

he overall audit statement is a qualitative evaluation of the indings. he follow-up

scoring (see Section D, Chapter 7.2.3) measures the implementation and efectiveness of the actions taken in response to an audit. In case of any new indings the
assessment of the implementation of the recommendations and the new indings
are be rated separately and then combined into a inal rating. his means that in
every audit cycle a quality history is created, i.e., a grading of substantive and formal
quality, which provides a qualitative overview of the auditees and their management. For measuring the subsequent actions, it is therefore important to ind out
whether none or few problems have been resolved in response to an audit, i.e., if
most of the recommendations are still open or in process. Escalation may follow if
recommendations are not implemented, resulting in the following action:
he auditors must enter open or in process in the GIAS status column of
the implementation report (see Section B, Chapter 5.2.3).

504

Special Topics and Supplementary Discussion

Escalation Procedure

D | 6

he status in the management and Board summaries is updated on the basis of

the details given in the implementation report.
he results of audit activities are continually communicated and discussed with the
responsible managers. In exceptional cases, diferences of opinion about audit indings may arise at the closing meeting or when the drat audit report is prepared.
Ideally, management will voice a difering opinion during the audit or no later than
the closing meeting. he audit lead is responsible for trying to reconcile difering
opinions and to reach a consensus if possible. However, if no consensus is reached,
escalation may ensue.
Two basic options can be pursued if the diferences of opinion between Internal
Audit and the management of the audited unit cannot be resolved. Management
either accepts the audit inding under dispute, despite difering opinion, or it does
not accept it. If management does accept it, it can explain its view in the Management action/response column of the drat audit report and document its difering
opinion. he audit lead should make it clear that, although managements comments are noted, the relevant recommendations have to be implemented. his has
to be documented in the working papers, preferably also in the Management action/response column. he follow-up will speciically look at the implementation
of such audit indings. In such cases, it is normally possible to resolve diferences by
de-escalation.
If in spite of intensive exchanges of views and discussions of a inding or recommendation, Internal Audit and the auditees do not agree the audit lead should
initially try to resolve the issue. Should such a resolution not be possible, the Audit
Manager must be informed. If the problem persists, it is lagged by inserting management disagreed under Internal Audit status in the implementation report. his
shows that Internal Audit and management have not reached agreement. In line
with Internal Audits cooperative approach, the auditor should, however, adopt
a cautious and considerate attitude, because Internal Audit will be more successful
if it can convince rather than enforce.
he audit lead may only drop a inding if it can be convincingly refuted. For
example, if compelling documents or evidence are submitted that were not included
in the audit and now contradict Internal Audits indings, the relevant indings in
the audit report will either be reworded or omitted. his must be documented in
the working papers.
In addition to the scenarios already mentioned, there may be other situations
that trigger an escalation process:
Management accepts the audit inding but not the recommendation.
he management of an audited area agrees with the audit indings and recommendations, but regional management does not, or vice versa.
he auditors should try to resolve diferences of opinion before distributing the
inal audit report.

505

Diferent opinions

Acceptance
of the Audit Finding

Management Disagreed

Dropping Audit Findings

Further Reasons
for Escalation

Diagram

he following diagram shows the escalation process at the time of reporting

with and without consensus and acceptance.

Fig. 18 Diferent Procedures with or without Agreement about Audit Findings and Recommendations

Escalation Unavoidable

In spite of all the eforts outlined above, it is possible that escalation may be the only
option let. his means that, in addition to the above steps, the following action will
have to be taken:
he persons responsible in Corporate Financial Reporting and Corporate Risk
Management (and in other corporate departments if appropriate) assess and
process the items under dispute.
Internal Audit assesses the status of actions during the follow-up and changes
the status to done if the cause of the inding has been eliminated.
If the follow-up status shows that the disagreement persists, the issue must again
be escalated to the Board and to the Audit Committee.
Ater a follow-up, any problems unresolved due to lack of agreement should
again be reported to the units mentioned above.

506

Special Topics and Supplementary Discussion

Escalation Procedure

Some matters may be escalated irrespective of the audit indings and recommendations made, for example, if the auditees have identiied inappropriate auditor
behavior or defects have been found in the auditors ieldwork. In this case, the auditees can escalate directly to the audit lead and/or Audit Manager. Moreover, the
audit teams assessment in the audit survey (see Section D, Chapter 7.2.2) may trigger escalation. he Audit Manager and/or the CAE are responsible for determining
the causes of escalation and for de-escalating the matter.
Hints AnD tiPs

Auditors should be considerate of the approach taken by the auditees in the situation concerned.
he communication of critical audit indings requires consideration and judgment to decide between immediate escalation and an attempt to convince management.
Auditors should always ofer their help in dealing with audit indings.

507

D | 6
Escalation Unrelated
to Findings and
Recommendations