ACCA Strategic Professional · Strategic Business Leader · Management and internal control systems

Mirabel Foods Inc.'s internal auditors have just completed a review that found weak authorisation controls over supplier master data. The chief executive asks the internal audit team to design and implement the replacement controls and then to audit them next year. What is the most appropriate response from a governance perspective?

Internal audit should decline to design and implement the controls. Management owns controls, and auditing its own work would create a self-review threat to objectivity. Internal audit reports the weakness, advises, and later independently tests whether management's new controls work.

AAgree, because internal audit has the best understanding of the weakness
BAgree, provided the external auditor is informed afterwards
CDecline to implement them; management should design and own the controls, while internal audit advises and later provides independent assuranceCorrect
DDecline all further involvement, including reporting the finding to the audit committee

Explanation

Designing and implementing controls is a management responsibility. If internal audit did so, it would later audit its own work, creating a self-review threat to objectivity. Internal audit should report the weakness and recommend improvements, and then give assurance on them.

Did you get it right without looking?

One question tells you little. A timed set on Management and internal control systems shows your real accuracy, how long you take and where you lose marks.

Practise Management and internal control systems Free diagnostic mock

More Management and internal control systems questions