Which of the following situations undermines the independence of the internal audit activity?

Question

Options

• AThe internal audit activity is responsible for the company's risk management function, and its
• BA senior member of the internal audit activity once worked in the corporate finance department.
• CThe organization's CEO reviews the internal audit activity's annual budget per the organization's
• DThe internal audit activity often uses management's risk profile to build its own risk profile for

• A
  74% (20)
• B
  7% (2)
• C
  4% (1)
• D
  15% (4)

Explanation

Option A is correct because when internal audit owns the risk management function, it loses objectivity - it cannot independently evaluate processes it is responsible for operating, creating a direct self-review threat that fundamentally compromises independence under IIA standards.

Why the distractors are wrong:

• B is incorrect because past employment in another department is a historical association, not a current operational conflict. Independence is assessed based on present responsibilities, not prior roles (though auditors should recuse themselves from auditing areas they recently managed).
• C is incorrect because CEO budget review is a normal governance activity. Independence would only be threatened if management could weaponize the budget to suppress unfavorable findings - routine approval is not that.
• D is incorrect because referencing management's risk profile as a starting point is efficient and acceptable practice; internal audit still applies its own professional judgment to build its final risk assessment.

Memory tip: Think of independence as "you can't grade your own homework." The moment internal audit does something operationally (manages risk, controls assets, makes business decisions), it loses the right to audit that same thing impartially. Ask yourself: Is audit wearing two hats? If yes, independence is compromised.

No community discussion yet for this question.