Which of the following qualifies as an acceptable consulting service provided by the internal audit activity?

Question

Options

• ADevelop training and system rollout plans in response to the results of the change readiness
• BLead a risk self assessment session for laboratory managers to help identify inherent risks and
• CAudit a third party cloud service provider to review the effectiveness of governance and
• DConduct a post-implementation assessment of the enterprise resource planning system to

• A
  6% (2)
• B
  71% (24)
• C
  15% (5)
• D
  9% (3)

Explanation

Option B is correct because facilitating a risk self-assessment session is a textbook consulting engagement - internal audit provides expertise and guidance while management retains ownership of identifying and evaluating risks. This preserves auditor independence since the audit activity is advising, not deciding.

Option A is wrong because developing training and rollout plans crosses into a management function. If internal audit builds these plans, it would later be auditing its own work, impairing objectivity - a core independence violation.

Option C is wrong because auditing a third-party provider to assess governance effectiveness is an assurance engagement, not consulting. The word "audit" signals an independent evaluation with an objective opinion, not an advisory role.

Option D is wrong because a post-implementation assessment is also an assurance engagement - it renders an opinion on how well the ERP was implemented. If internal audit was involved in the implementation, this would further impair independence.

Memory tip: Ask yourself - who owns the outcome? In consulting, management owns the decision and internal audit just facilitates or advises (like a coach). In assurance, internal audit independently evaluates and opines. Anything that makes internal audit "do the work" instead of "advise on the work" either crosses into management's role or becomes assurance.

No community discussion yet for this question.