The internal audit activity is responsible for which of the following actions related to an organization’s internal controls9

Question breakdown

Tests

Distinguish internal audit's role in internal control from management's role

Difficulty

Easy

Key idea: Management owns and operates controls, while internal audit evaluates them and advises on their effectiveness and efficiency, including whether their cost is justified.

How to reach the answer

1. The question asks what internal audit is responsible for, so screen out anything management owns.
2. Mitigating risks and enabling opportunities are management actions; internal audit taking them would impair objectivity.
3. Attesting to the fairness of financial statements is the external auditor's role.
4. Evaluating efficiency, which includes weighing control costs against benefits, and advising on it is a recognized assurance and consulting activity of internal audit.

Each option

• AIncorrect. Risk mitigation is a management responsibility; internal audit evaluates mitigation but does not perform it.
• BIncorrect. Pursuing opportunities is an operational decision that belongs to management, not to the audit function.
• CCorrect. Assessing whether controls are efficient relative to the risk they address, and advising on that, falls within internal audit's evaluation and consulting role.
• DIncorrect. An opinion on the fairness of financial statements is issued by the independent external auditor.

Common trap: Option A sounds like a core control objective, which can lead candidates to forget that internal audit assesses risk mitigation instead of owning it.

In practice: During control reviews, auditors often find redundant or over-engineered controls and recommend simplifying them where the cost exceeds the risk reduction.

Remember: Internal audit evaluates and advises on controls, cost-effectiveness included; management designs and runs them.

Drafted with AI assistance and checked against the answer key.