An internal audit team was assigned to review the organization's information security protocol After fieldwork was completed an internal auditor identified an error in the review of security access…

Question

Options

• AProceed with addressing the error and report any corrections to the engagement supervisor
• BIssue the audit report to senior management on schedule but include a disclaimer about the error
• CProceed with the scheduled closing of the engagement without consideration of the identified
• DInform the engagement supervisor of the error and allow the supervisor to determine the

• A
  5% (3)
• B
  10% (6)
• C
  2% (1)
• D
  84% (52)

Explanation

Option D is correct because internal auditors must maintain proper communication channels - when an error is discovered that could affect engagement results, the auditor's responsibility is to escalate to the engagement supervisor, who has the authority and broader context to decide how to address it. This reflects the IIA Standards, which require auditors to communicate significant findings and preserve supervisory oversight.

Why the distractors fail:

• A is wrong because the auditor should not independently proceed with corrections before supervisor involvement - self-directed fixes bypass the chain of command and could introduce further errors or conceal the issue.
• B is wrong because issuing a report with known material errors - even with a disclaimer - is inappropriate; the error must be resolved, not disclosed-and-shipped.
• C is wrong because ignoring an error that could affect overall results violates professional standards and audit integrity entirely.

Memory tip: Think of it as the "escalate, don't self-fix" rule. In auditing, an individual auditor's job is to find and report issues up the chain, not to unilaterally resolve them. If the choice involves a supervisor being informed, that's almost always the right move when something goes wrong mid-engagement.

No community discussion yet for this question.