According to IIA guidance, which of the following is ultimately responsible for seeing that the internal control system of an organization's social responsibility program is effective?

Question

Options

• ASenior management
• BInternal audit activity.
• CAll employees.
• DBoard of directors.

• A
  15% (7)
• B
  72% (33)
• C
  9% (4)
• D
  4% (2)

Explanation

According to IIA guidance on evaluating social responsibility programs, the internal audit activity holds ultimate responsibility for assessing whether the controls governing those programs are functioning effectively - this is a direct extension of internal audit's core mandate to evaluate and improve the effectiveness of governance, risk management, and control processes. While senior management (A) designs and implements internal controls, their role is operational accountability, not independent verification - they cannot objectively assess what they themselves put in place. All employees (C) may participate in or support social responsibility initiatives, but they bear no formal accountability for control effectiveness at the system level. The Board of Directors (D) provides high-level governance oversight and sets the tone at the top, but oversight is not the same as hands-on responsibility for evaluating whether control systems actually work.

Memory tip: Think of internal audit as the "independent eyes" - management builds the controls, the board oversees strategy, but only internal audit is positioned to independently verify effectiveness. When a question asks who ensures a control system is effective, look for the assurance provider, not the implementer.

No community discussion yet for this question.