Which of the following would be most helpful to measure whether an internal audit activity successfully provides risk-based assurance?

Question

Options

• APercentage of highly significant risks covered by internal audit plan.
• BPercentage of previously unknown risks identified per engagement.
• CPercentage of internal audit staff skilled in alignment with the organization's structure and key
• DPercentage of observations made in assurance engagements compared to advisory engagements.

• A
  11% (3)
• B
  4% (1)
• C
  82% (23)
• D
  4% (1)

Explanation

Measuring whether internal audit successfully delivers risk-based assurance hinges on whether the audit team has the competencies to actually evaluate the risks present in the organization. Option C is correct because staff skills aligned with the organization's structure and key risk areas directly determines the quality and credibility of assurance delivered - without the right expertise, audit work on critical risks is superficial regardless of what the plan says.

Why the distractors fall short:

• A measures audit planning coverage (an input), not whether assurance was successfully delivered with quality - a plan can cover all major risks yet still produce weak assurance if staff lack relevant skills.
• B reflects a discovery or consulting outcome rather than assurance; finding unknown risks is a bonus, not the core purpose of providing risk-based assurance.
• D measures engagement type mix, which says nothing about whether either type of engagement was risk-focused or high-quality.

Memory tip: Think of it as "Right People, Right Risks" - if the audit team's skills don't match the organization's risk profile, the assurance they provide is hollow. Staff competency alignment is the engine that makes risk-based assurance actually work, making it the best proxy for success.

No community discussion yet for this question.