An internal auditor believes that a weakness exists in the control environment relating to the delegation of authority and responsibility within the management structure. Which of the following…

Question

Options

• ARecommend a control change and obtain management support.
• BEvaluate the potential Impact on related controls.
• CAddress the risk with senior management and the board.
• DDevelop and communicate the scope and evaluation criteria to be used by management.

• A
  3% (1)
• B
  84% (32)
• C
  3% (1)
• D
  11% (4)

Explanation

Option B is correct because when an auditor first identifies a suspected control weakness, their immediate priority is to understand the full picture before acting. A weakness in delegation of authority can cascade into related controls (e.g., segregation of duties, approval workflows, access rights), so the auditor must assess that broader impact to determine severity and scope before taking any further steps.

Why the distractors are wrong:

• A (Recommend a control change) - Premature. You cannot responsibly recommend a fix without first knowing how far the weakness extends or how severe it is.
• C (Address with senior management/board) - Escalation comes after the auditor has enough information to report meaningfully; going up the chain without impact data is uninformed and potentially alarmist.
• D (Develop scope and evaluation criteria for management) - This describes framing a management self-assessment, which is a different process entirely, and still skips the auditor's own impact analysis.

Memory tip: Use the phrase "Assess → Then Act." In audit questions, whenever you see a newly discovered weakness, the first step is almost always evaluation/assessment (understand impact, gather evidence) - never jumping straight to recommendations, escalation, or communication.

No community discussion yet for this question.