Glossary term
Management Action Plan (MAP)
Subject: Governance, Internal Control and Audit
Also known as: Management Response, Action Plan
A management action plan is management's written commitment to fix an audit or review finding, stating what will be done, who is responsible, and by what date.
Explanation
After an audit finding is agreed, management responds with specific steps rather than general intentions. A useful plan names an accountable owner, breaks the work into actions, sets dates that can be checked, and says what evidence will show it is complete. It should deal with the cause of the problem and not only the symptom. Internal audit records the actions in a tracker, monitors progress, and later validates that the fix works, which is usually called follow-up. Overdue or extended actions are reported to the audit committee, often with the age of the oldest items. Some functions allow management to accept a risk instead of acting, which should be formally approved at a suitably senior level. Plans from other sources, such as regulators or risk reviews, may be tracked in the same way. Until its actions are completed and checked, an audit report changes nothing.
Example
An audit finds that a hospital pharmacy does not reconcile controlled drug stock monthly. The pharmacy director agrees an action plan: reconcile at month end starting next quarter, report differences above a set level to the medical director, and provide the first three reconciliations as evidence. Internal audit closes the item once it has reviewed them.
Not to be confused with
- Audit Finding
- The finding describes the weakness found. The action plan is management's agreed response to it, with owner and date.