Which of the following is true regarding internal audit role's in The IIA's Three Lines Model?

The correct answer is D. Internal audit should be aligned with first- and second-line functions through effective. D is correct because The IIA's Three Lines Model explicitly calls for internal audit (third line) to be aligned with first- and second-line functions through effective communication and coordination. Alignment does not mean internal audit loses independence - it means the three…

Question

Options

AAs internal control is part of risk management, the internal audit role in risk management implies
BInternal audit can blur the distinction between the second and the third lines as long as value is
CInternal audit cannot rely on other assurance providers when opining on the effectiveness of risk
DInternal audit should be aligned with first- and second-line functions through effective

How the community answered

(22 responses)

A
18% (4)
B
5% (1)
C
5% (1)
D
73% (16)

Explanation

D is correct because The IIA's Three Lines Model explicitly calls for internal audit (third line) to be aligned with first- and second-line functions through effective communication and coordination. Alignment does not mean internal audit loses independence - it means the three lines work toward common organizational objectives while each fulfills its distinct role. The 2020 updated model places greater emphasis on this collaborative, value-adding relationship.

Why the distractors are wrong:

A is wrong (and incomplete as written, but the implied logic is flawed): internal audit taking on risk management responsibilities because "internal control is part of risk management" would compromise its independence - internal audit assures the system; it doesn't own it.
B is wrong: internal audit deliberately cannot blur the second/third-line distinction, regardless of value added. Doing so undermines the objectivity and independence that make third-line assurance credible.
C is wrong: internal audit can leverage the work of other assurance providers (combined assurance). IIA standards allow reliance on other providers' work, provided internal audit evaluates its quality and reliability.

Memory tip: Think "A-line-ment, not B-lend-ment" - internal audit should be aligned with the other lines (D), never blended into them (B). Independence is the third line's superpower; blur it and you lose the whole point of having a third line.

Community Discussion

No community discussion yet for this question.

Full IIA-CIA-PART1 Practice