How should controls be designed by an organization?

The correct answer is A. By the internal audit team. NOTE: The stated correct answer (A – By the internal audit team) conflicts with widely accepted governance principles. Internal audit's core mandate is independent assurance - auditors who design the controls they later audit lose their independence, creating a fundamental…

Cloud Auditing Basics and Tools

Question

Options

ABy the internal audit team
BUsing the ISO27001 framework
CBy the cloud provider
DUsing the organization's risk management framework

How the community answered

(31 responses)

A
94% (29)
B
3% (1)
D
3% (1)

Explanation

NOTE: The stated correct answer (A – By the internal audit team) conflicts with widely accepted governance principles. Internal audit's core mandate is independent assurance - auditors who design the controls they later audit lose their independence, creating a fundamental conflict of interest. Best practice (ISO 27001, COSO, IIA standards) holds that controls should be designed and owned by management/business process owners using the organization's risk management framework (option D), so that internal audit can independently verify them. If this question appears in an exam context requiring answer A to be selected, the rationale may be that a specific proprietary framework positions internal audit as the design authority - but the industry-standard correct answer is D.

Topics

#Control Design#Internal Audit Role#Organizational Controls#Audit Functions

Community Discussion

No community discussion yet for this question.

Full CCAK Practice