Management Response
Definition
The audited organisation's formal reply to each finding, included in the report. It states whether the recommendation is accepted, rejected, or accepted with modification, names an owner, and commits to a remediation date. It creates accountability and a basis for follow-up.
- Appears in
- The final audit report, alongside each finding
- Possible stances
- Accepted, rejected, or accepted with modification
- Must include
- Named owner and committed remediation date
- Purpose
- Creates accountability and a basis for follow-up
Common questions
What happens when management rejects a finding in its response?+
A rejected finding is usually still published in the report along with the auditor's rationale, so the disagreement is visible to the audit committee or board rather than resolved unilaterally; some frameworks require a documented escalation path for unresolved disputes.
How is a management response different from remediation tracking itself?+
The response is a one-time formal commitment recorded at the time the report is issued, while remediation tracking is the ongoing process, often via a management action plan, that monitors whether the committed date and evidence are actually delivered.
Related terms
- Executive Summary
- The opening section of an audit report written for non-technical leadership. It states the audit scope, overall posture, the most material findings...
- Finding
- A discrete, evidence-backed statement that a specific control is absent, misconfigured, or insufficient. Each finding contains an issue statement, evidence, risk rating,...
- Nonconformity
- The ISO 27001 term for a finding that represents a failure to meet a requirement of the standard or the organisation's own...
- Observation
- A noted issue or improvement opportunity that does not constitute a formal finding because it lacks sufficient evidence or does not violate...
- Risk Rating
- A classification of a finding's severity, typically Critical, High, Medium, Low, or Informational, derived from a likelihood-by-impact matrix. The rating determines remediation...