An internal auditor has documented several instances in which management asked employees to ad against the policies and procedures. Which of the following is the most appropriate next step?

Question

Options

• AReport the non-compliance cases to the board of directors.
• BRecommend that management update its policies and procedures based on the circumstances.
• CInvestigate the rationale for management's actions.
• DRecommend those employees to report the cases through the designed whistleblowing channel

• A
  73% (35)
• B
  2% (1)
• C
  17% (8)
• D
  8% (4)

Explanation

When management instructs employees to act against established policies and procedures, this represents a serious governance failure that bypasses normal management authority - making escalation to the board of directors the correct step, since the board is the oversight body responsible for holding management accountable and cannot fulfill that role if kept unaware.

Why the distractors fail:

• B is wrong because management cannot legitimately resolve its own non-compliance by simply rewriting the rules to match its behavior - that would undermine the entire control environment.
• C is wrong because investigating rationale is a secondary step; the auditor has already documented the instances, and the severity of management override demands immediate escalation, not further inquiry first.
• D is wrong because whistleblowing channels are designed for employees to report concerns about management - the auditor has already identified the issue and has a direct professional duty to report it up the governance chain.

Memory tip: Think of it as the "skip-level" rule - when the problem is management, you skip management and go to whoever oversees management, which is the board. The auditor's independence exists precisely for this scenario.

No community discussion yet for this question.