Which of the following would be the most suitable internal control framework for an organization to adopt?

Question

Options

• AA framework that specifies common best practices for an organization to evaluate and benchmark.
• BA framework that specifies correct and incorrect business methodologies.
• CA framework with precise specifications for how controls and processes should be employed.
• DA framework that offers step-by-step guidance for remedial action for all organization types.

• A
  82% (40)
• B
  4% (2)
• C
  2% (1)
• D
  12% (6)

Explanation

Option A is correct because effective internal control frameworks - like COSO or COBIT - are designed to provide best practices and benchmarks that organizations can adapt to their specific context, risk profile, and industry. They are intentionally flexible rather than prescriptive, allowing organizations to evaluate their own controls against a common standard and identify gaps.

• B is wrong because frameworks don't dictate "correct vs. incorrect" business methods; they guide risk management and control design, not business strategy.
• C is wrong because overly precise, rigid specifications would make a framework impractical - organizations vary too much in size, industry, and risk appetite for one-size-fits-all rules.
• D is wrong because no single framework provides step-by-step remedial guidance applicable to all organization types; remediation is always context-dependent and organization-specific.

Memory tip: Think of an internal control framework as a ruler, not a recipe - it gives you a standard to measure against and benchmark your controls, not a fixed set of steps to follow.

No community discussion yet for this question.