Skip to content

ACCA Strategic Professional · Strategic Business Leader · Managing, monitoring and mitigating risk

Orlin Pharma operates a three lines model. The head of internal audit also manages the compliance monitoring team and has recently designed new control procedures for the sales function, which she will now audit. Which conclusion is most appropriate?

Internal audit's independence and objectivity are impaired. In the three lines model, internal audit is the independent third line, yet here it manages compliance and designed the controls it will audit, creating self-review. Notifying the audit committee afterwards or relying on external review does not remove this structural conflict.

  1. AThe arrangement is sound because internal audit has the best understanding of controls
  2. BThe arrangement is sound if the audit committee is informed afterwards
  3. CThe arrangement is acceptable as long as the external auditor reviews the work
  4. DInternal audit's independence and objectivity are impaired because it has taken on second line and management responsibilities and would audit its own designCorrect

Explanation

In the three lines model, management owns risk and controls (first line), risk and compliance functions oversee (second line), and internal audit provides independent assurance (third line). Designing controls and managing compliance, then auditing them, creates a self-review threat and undermines independence. Informing the audit committee afterwards or external auditor review does not remove the structural conflict.

Did you get it right without looking?

One question tells you little. A timed set on Managing, monitoring and mitigating risk shows your real accuracy, how long you take and where you lose marks.

Practise Managing, monitoring and mitigating riskFree diagnostic mock

More Managing, monitoring and mitigating risk questions