Skip to content

ACCA Strategic Professional · Strategic Business Leader · Management and internal control systems

Tessera Energy plc's internal audit plan is currently built around a rotating cycle that audits every department once every three years. Following a major strategic expansion into new overseas markets and a cyber incident at a competitor, the audit committee wants internal audit to add most value. Which approach best fits this aim?

A risk-based internal audit plan, linked to the risk register and strategy and updated as risks change, adds the most value. It focuses on high-risk areas like overseas expansion and cyber security, unlike a fixed rotating cycle or duplicating external audit work.

  1. ARetain the three-year cycle so every area receives equal coverage
  2. BConcentrate on re-performing the external auditor's financial statement tests
  3. CAdopt a risk-based plan, linked to the board's risk register and strategy, prioritising high-risk areas such as overseas operations and IT security, and updated as risks changeCorrect
  4. DRestrict the plan to compliance checks on procedures that management specifies

Explanation

A risk-based plan aligns audit effort with the organisation's significant and changing risks and strategy, giving the board the most relevant assurance. A fixed cycle gives equal coverage regardless of risk, duplicating external audit adds little, and management-directed compliance checks limit independence and value.

Did you get it right without looking?

One question tells you little. A timed set on Management and internal control systems shows your real accuracy, how long you take and where you lose marks.

Practise Management and internal control systemsFree diagnostic mock

More Management and internal control systems questions