What is the best course of action when the internal audit activity does not have the knowledge necessary to perform a planned audit of the organization's new IT data backup process?

Question

Options

• APostpone the audit engagement to a later date.
• BRecruit and hire a full-time staff auditor who is proficient in data backup processes.
• CChange the plan from an assurance engagement to a consulting engagement.
• DProvide data backup training to the engagement supervisor.

• A
  6% (2)
• B
  81% (26)
• C
  9% (3)
• D
  3% (1)

Explanation

Recruiting a full-time staff auditor with data backup expertise (B) is the best course of action because the IIA Standards require that internal audit engagements be performed by individuals who collectively possess the knowledge, skills, and other competencies needed - and when a competency gap exists for a planned audit, the appropriate fix is to obtain that competency through staffing.

Why the distractors fail:

• A (Postpone) - Delaying doesn't solve the competency gap; the audit will still need to be performed eventually and the gap will remain.
• C (Change to consulting) - Switching engagement types doesn't resolve the knowledge deficiency and inappropriately avoids the assurance obligation; the type of engagement should be driven by the audit objective, not by resource limitations.
• D (Train the supervisor) - Training one supervisor is a slower, uncertain fix and doesn't guarantee sufficient competency before the engagement must be conducted; it also misplaces responsibility on management rather than addressing the structural staffing need.

Memory tip: Think of it as the "right person for the right job" rule - the IIA Standards emphasize collective competency of the audit team, so the cleanest solution to a missing skill is to bring in someone who has it permanently, not to patch around the gap.

No community discussion yet for this question.