Which of the following best describes the role of internal control frameworks?

Question

Options

• AThey outline specific internal controls for an organization to implement to ensure business
• BThey provide guidance related to internal control design and implementation to assist with the
• CThey serve as a list of appropriate internal controls for auditors to ensure an organization is using
• DThey serve as a template for identifying standardized best practices in effective risk management

• A
  18% (3)
• B
  71% (12)
• C
  6% (1)
• D
  6% (1)

Explanation

Internal control frameworks - such as COSO or COBIT - are designed to provide guidance on how to design and implement controls, not to prescribe specific controls for every organization (B). They are principles-based, leaving organizations to tailor controls to their own risk environment and objectives.

Why the distractors fail:

• A is wrong because frameworks don't mandate specific controls; they offer a structure for organizations to develop their own appropriate controls.
• C is wrong because frameworks are not checklists for auditors - auditors use professional judgment, standards, and the organization's own control documentation, not a universal "approved controls" list.
• D is partially plausible but wrong because frameworks address internal controls broadly (not just risk management), and they provide guidance rather than rigid "standardized best practices" templates.

Memory tip: Think of a framework like a building code - it tells you how to approach construction safely (guidance), not exactly which bricks to use (specific controls). The word "guidance" in option B is the key signal on the exam.

No community discussion yet for this question.