Skip to content

CS Professional · Internal and Forensic Audit · Practices related to Internal Auditing

Internal audit at Gomti Engineering Ltd noticed during follow-up that management had not acted on a high-risk recommendation on unauthorised vendor master changes and said it had decided to accept the risk. The chief audit executive believes the residual risk is unacceptable to the company. What is the most appropriate course of action?

The chief audit executive should discuss it with senior management and, if unresolved, escalate to the audit committee or board. Deleting the finding hides a significant risk, and implementing the control would impair independence because management owns controls. Delay leaves a high-risk exposure unaddressed.

  1. ADiscuss with senior management and, if unresolved, escalate to the audit committee or boardCorrect
  2. BDelete the finding from the report since management has accepted the risk
  3. CImplement the control personally in the vendor master system
  4. DWait until the next annual audit before raising the matter again

Explanation

Where management accepts a risk the chief audit executive considers unacceptable, the matter is first discussed with senior management and, if still unresolved, communicated to the board or audit committee. Deleting the finding compromises reporting integrity. Implementing the control would impair independence, since auditors must not take management responsibilities. Waiting leaves a high risk exposed.

Did you get it right without looking?

One question tells you little. A timed set on Practices related to Internal Auditing shows your real accuracy, how long you take and where you lose marks.

More Practices related to Internal Auditing questions