Senior management must ensure that all internal audit findings and recommendations are resolved within six months for high risk/critical issues and 12 months for any other issues from the issue date of the subject internal audit report.