Skip to content

ACCA Strategic Professional · Strategic Business Leader · Internal control and management reporting

Calder Plc's audit committee receives from management a quarterly risk report listing risks, owners and mitigations, all self-assessed as low. Internal audit testing then finds two key controls over inventory valuation were not operating, yet management had rated them effective. What does this most strongly imply for the committee's risk monitoring?

The committee should not rely solely on management self-assessment and should obtain independent assurance, such as internal audit testing of key controls. The mismatch between rated and actual control operation shows first-line reporting can be unreliable, but it should still be used, not abolished or handed to external auditors.

  1. AIt should not rely only on management self-assessment and should seek independent assurance such as internal audit testingCorrect
  2. BIt should abolish the risk report because management cannot assess risk
  3. CIt should delegate risk monitoring entirely to the external auditor
  4. DIt should accept the findings as isolated and take no action

Explanation

The gap between management's ratings and tested reality shows self-assessment is unreliable alone, so the committee needs independent assurance such as internal audit testing, a third line of defence view. Abolishing the report discards useful first-line information. The external auditor does not take over risk monitoring, and ignoring the finding leaves a control weakness unaddressed.

Did you get it right without looking?

One question tells you little. A timed set on Internal control and management reporting shows your real accuracy, how long you take and where you lose marks.

Practise Internal control and management reportingFree diagnostic mock

More Internal control and management reporting questions