An internal auditor is finalizing an audit report on the effectiveness of the organization's overall system of internal control. Several audit tests were performed, and the only issue identified was…

Question

Options

• AThe auditor should indicate that the system of internal control is not effective.
• BThe auditor should indicate that the system of internal control is generally effective, except for the
• CThe auditor should indicate that the system of internal control is effective.
• DThe auditor cannot express a conclusive opinion in the audit report.

• A
  71% (24)
• B
  18% (6)
• C
  9% (3)
• D
  3% (1)

Explanation

When the CEO - the highest-ranking official - routinely asks employees to bypass written policies, this represents management override of controls, which is a fundamental breakdown of the control environment (the foundational layer of the COSO internal control framework). Because the control environment underpins all other control components, a compromised tone at the top renders the entire system ineffective, making A the only defensible conclusion.

Why the distractors fail:

• B is wrong because "generally effective, except for..." grossly understates the severity - management override at the CEO level isn't an isolated gap; it poisons the reliability of every other control in the organization.
• C is wrong because you cannot certify a system as effective when its most critical component (the control environment / tone at the top) is actively being undermined.
• D is wrong because sufficient evidence does exist to form a conclusion - the issue is clear and well-documented, not ambiguous.

Memory tip: Think "the fish rots from the head." If the CEO is bypassing controls, no downstream control - no matter how well-designed - can be trusted to operate as intended, so the whole system fails.

No community discussion yet for this question.