ProAuditMap

Tracking audit findings: what DORA, MaRisk and the IIA Standards require.

A finding is closed only when implementation is confirmed. Three frameworks describe how internal audit shows this, and the new German MaRisk sets a faster pace.

As of 14 October 2026

Summary

DORA requires a formal follow-up process, the German MaRisk as amended on 30 June 2026 a quarterly report on all material deficiencies not yet remedied, and the Global Internal Audit Standards an established methodology to confirm implementation. This article summarises what follows for process, escalation and reporting.

DORA: a formal process

Article 6(7) DORA requires financial entities to establish, based on the conclusions of the internal audit review, a formal follow-up process, including rules for the timely verification and remediation of critical ICT audit findings [1].

Two points matter. The process has to be formal, that is described and traceable, not just practised. And it differentiates: critical findings need their own rules, both for remediation and for its verification.

MaRisk 2026: quarterly instead of annual reporting

The ninth amendment of the German Minimum Requirements for Risk Management (MaRisk) of 30 June 2026 groups the requirements for internal audit in AT 4.4.3. Internal audit has to monitor in an appropriate form that deficiencies are remedied on time, if necessary through a follow-up audit (para. 11) [2].

What is new is the pace. Under para. 9 internal audit prepares a report to management at least quarterly. It covers the material deficiencies found in the quarter with the measures to remedy them and their status, and all material deficiencies from earlier quarters that have not yet been remedied. Particularly serious deficiencies are reported without delay [2].

Escalation follows the same pace. If material deficiencies are not remedied within a reasonable time, the head of internal audit first informs the responsible members of management in writing. If the deficiencies persist, the entire management body is informed in the next quarterly report at the latest (para. 12) [2]. The 2024 version provided for the next overall report instead [3].

The grading into material, serious and particularly serious deficiencies remains; each institution defines the boundaries itself (para. 7) [2]. Additional requirements of the new version apply after a transition period ending on 1 January 2027 [4].

IIA Standards: confirm implementation, do not just ask

Standard 15.2 of the Global Internal Audit Standards requires internal auditors to confirm the implementation of recommendations or action plans following an established methodology. It includes inquiring about progress, performing risk-based follow-up assessments and updating the status in a tracking system. The extent depends on the significance of the finding [5].

If management does not progress as agreed, internal auditors obtain and document an explanation and discuss it with the chief audit executive, who determines whether management has accepted a risk above the risk tolerance by delay or inaction; Standard 11.5 on communicating the acceptance of risks then applies [5].

What a robust process contains

A common core can be derived from the three frameworks. It fits banks as well as organisations outside the financial sector that follow the IIA Standards.

  1. Every finding has a risk rating based on defined criteria, and the boundaries are documented.
  2. Every action has a responsible function and a due date. Changes of due dates go through a request with a decision, not silent postponement.
  3. A report of "implemented" by the audited unit does not close the finding. For high risks a follow-up check confirms effectiveness, with documented observations.
  4. Overdue actions trigger graded escalation: the responsible members of management first, then the entire management body in the next quarterly report.
  5. If management accepts a risk, this is recorded with function, reason and end date and presented again when it expires.
  6. The quarterly report shows all open material findings with age, status and due date, not only new ones.

Conclusion

With MaRisk 2026, follow-up becomes a quarterly management topic for German banks. Teams that track open findings in a spreadsheet and chase status by e-mail should check before 1 January 2027 whether status, escalation and follow-up checks can be evidenced at any time. The framework for audit planning in 2027 is covered in our article Audit planning 2027 under NIS2 and DORA.

How ProAuditMap handles findings, actions, follow-up checks and risk acceptance is shown on the product page. Sample audit programs are freely available: sample audit programs.

NIS2 and DORA scope check

Sources (retrieved on 14 October 2026)

  1. Regulation (EU) 2022/2554 (DORA), Article 6(7): https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2554
  2. BaFin, Circular 06/2026 (BA), MaRisk of 30 June 2026, AT 4.4.3 (German): https://www.bundesbank.de/resource/blob/825336/866a68577eb35afee82fbe60c39a4f87/472B63F073F071307366337C94F8C870/2026-06-30-rundschreiben-data.pdf
  3. BaFin, Circular 06/2024 (BA), MaRisk of 29 May 2024, BT 2.5 (German): https://www.bundesbank.de/resource/blob/932738/fa6ddd3636c40c9f9d5cb4fad4f07121/472B63F073F071307366337C94F8C870/2024-05-29-rundschreiben-data.pdf
  4. Deutsche Bundesbank, cover letter to MaRisk of 30 June 2026, transition period (German): https://www.bundesbank.de/resource/blob/817668/a01783da8a8eb23ba9fe333001d85c41/472B63F073F071307366337C94F8C870/2026-06-30-anschreiben-data.pdf
  5. The IIA, Global Internal Audit Standards (2024), Standards 15.2 and 11.5: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/

This article gives an overview and is not legal advice. The wording of the provisions and standards cited is authoritative.