An organization is outsourcing its payroll system and is requesting to conduct a full audit on the third- party information technology (IT) systems. During the due diligence process, the third party…

Question

Options

• AThe audit assessment has been conducted by an independent assessor.
• BThe audit reports have been signed by the third-party senior management.
• CThe audit reports have been issued in the last six months.
• DThe audit assessment has been conducted by an international audit firm.

• A
  5% (3)
• B
  82% (54)
• C
  3% (2)
• D
  11% (7)

Explanation

Signing by senior management is the critical acceptability requirement because it establishes accountability and authenticity - it confirms that the organization's leadership has formally reviewed, accepted, and taken ownership of the audit findings, making the report an official and binding organizational document rather than an unverified draft.

Why the distractors are wrong:

• A (Independent assessor) is a quality best practice, but independence alone doesn't determine whether a report is acceptable to the receiving organization - many valid internal or semi-independent assessments exist.
• C (Last six months) imposes an arbitrary timeframe; no universal standard mandates a six-month window, and audit validity depends on the scope and nature of changes, not a fixed calendar rule.
• D (International audit firm) is unnecessarily restrictive - domestic or regional firms are fully capable of conducting credible, rigorous audits.

Memory tip: Think of senior management sign-off as the "official seal" on a legal document - without it, the report is just a paper without authority. Ask yourself: Who is accountable for what this report claims? If no named executive has put their signature to it, the organization accepting the report has no one to hold responsible if the findings are inaccurate or outdated.

No community discussion yet for this question.