An internal auditor determines that certain information from the engagement results is not appropriate for disclosure to all report recipients because it is privileged. In this situation, which of…

Question

Options

• ADisclose the information in a separate report.
• BDistribute the information in a confidential report to the board only
• CDistribute the reports through the use of blind copies.
• DExclude the results from the report and verbally report the conditions to senior management and

• A
  70% (31)
• B
  18% (8)
• C
  5% (2)
• D
  7% (3)

Explanation

Issuing a separate report for privileged information is the approach endorsed by IIA Standards because it preserves documentation of the findings while allowing the auditor to control distribution to only those authorized to receive sensitive content - maintaining both transparency and confidentiality appropriately.

Why the distractors are wrong:

• B is too restrictive: routing sensitive results exclusively to the board bypasses other stakeholders who may have a legitimate need and authority to receive them, and it isn't the standard prescribed mechanism.
• C is procedurally flawed: blind copies (BCC) hide who received information but don't actually restrict or control access to it - this is not a recognized confidentiality control in auditing.
• D is the weakest option: verbal reporting leaves no audit trail, violates the IIA's requirement for written communication of engagement results, and omitting findings from documentation undermines audit integrity.

Memory tip: Think of it as "compartmentalize, don't eliminate." Privileged information still needs to be reported (ruling out D) and documented (ruling out C), just to the right audience - a separate report is the clean solution that satisfies both obligations.

No community discussion yet for this question.