If follow-up discovers that actions and controls haven't been implemented, it is important to use professional judgment and work with the action owner to understand why the plans have not been implemented. Immediate escalation to the board without understanding the context may not be the most effective approach. Engaging with the action owner can help identify obstacles and facilitate a constructive resolution. Escalation should be considered if there is a significant risk or if there is consistent non-compliance despite reasonable efforts to address the issue.References:
* ISO 19011:2018 - Guidelines for auditing management systems
* IIA Standards for the Professional Practice of Internal Auditing