An internal auditor determines that the process is not designed adequately to reduce the underlying risks to an acceptable level. Which of the following should the internal auditor do next?
a) Postpone the engagement until the design inadequacy has been rectified.
b) Test the existing key controls anyway to prove that, despite the design inadequacy, the process is still meeting the process objectives.
c) Test compensating controls in other (adjacent) processes to see if the impact of the design inadequacy is reduced to an acceptable level.
d) Write the audit report. There's no reason to test the operating effectiveness of controls that are not designed adequately.
Answer: c) Test compensating controls in other (adjacent) processes to see if the impact of the design inadequacy is reduced to an acceptable level.
You might also like to view...
Collective marks are marks identifying the producers as belonging to a larger group
Indicate whether the statement is true or false
________ measures the return earned on the common stockholders' investment in the firm
A) Net profit margin B) Price/earnings ratio C) Return on equity D) Return on total assets