Follow-up and implementation of audit recommendations

IA recommendations are followed up by the IA units within one year (%)

Review of data provided by the CHU, to verify the percentage of IA recommendations made during the year prior to the latest full calendar year that have been followed up during the latest full calendar year by IA units. The follow-up rate is expressed as a percentage of the total number of recommendations. Follow-up by IA units may include: - requirement for the audited entity to present an action plan for the fulfilment of the recommendations - obligation for the audited entity to self-track implementation - periodic reporting on the implementation of the action plan or on the result of the self-assessment - systematic interviews and questionnaires to be completed by the audited entity, or updated risk registers. Points are allocated based on the percentage of IA recommendations that are followed up by the IA units within one year (x): • x < 50% = 0 points. • 50% ≤ x < 90% = linear function. • x ≥ 90% = 5 points.

IA recommendations are accepted by the auditees (%)

Review of data provided by the CHU, to verify the percentage of IA recommendations made during the year prior to the latest full calendar year that have been accepted by the audited entities during the latest full calendar year. Accepted means that the recommendation is agreed to by management and is followed by a risk mitigation action documented in the action plan or risk register. The acceptance rate is expressed as a percentage of the total number of recommendations. Points are allocated based on the percentage of IA recommendations that are accepted by auditees (x): • x < 40% = 0 points. • 40% ≤ x < 80% = linear function. • x ≥ 80% = 5 points.

Reported implementation rate of internal audit recommendations accepted by the auditees (%)

Review of data provided by the CHU, to verify the percentage of IA recommendations made by the IA units the year prior to the latest full calendar year that are fully and partially implemented by the end of the latest full calendar year (partially implemented recommendations are counted at a weight of 50%. For example, if 20% of recommendations are partially implemented, they are included at 10% in the percentage share of recommendations implemented). Points are allocated based on the reported implementation rate of IA recommendations accepted by the auditees (x): • x < 30% = 0 points. • 30% ≤ x < 80% = linear function. • x ≥ 80% = 5 points.