The internal audit activity is responsible for which of the following actions related to an organization’s internal controls9

The internal audit activity is responsible for evaluating the effectiveness and efficiency of internal controls. A key component of evaluating efficiency is assessing whether the cost of implementing and maintaining a control is justified by the benefit it provides in terms of risk reduction. This cost-benefit analysis is a critical advisory function that helps the organization maintain a practical and economical control environment. This aligns with internal audit's role to add value and improve an organization's operations by providing objective advice and insight.

A. Mitigating risks affecting achievement of organizational objectives. This is a primary responsibility of management, which owns the risks and is responsible for designing, implementing, and maintaining controls to mitigate them.
B. Enabling opportunities affecting achievement of organizational objectives. This is a strategic and operational function belonging to management. Internal audit may advise on associated risks but does not own the pursuit of opportunities.
D. Attesting to fairness of financial statements. This is the primary responsibility of the independent external auditor, who provides an opinion on the financial statements for use by external stakeholders.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards).

Standard 2130: Control: "The internal audit activity must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement."

Interpretation of Standard 2130: "Internal auditors’ evaluation of the effectiveness of the organization’s control processes may include, for example, determining whether the processes provide a reasonable level of assurance that risks are managed and that organizational objectives will be achieved efficiently and economically." The term "economically" directly implies a cost-versus-benefit consideration.

2. The Institute of Internal Auditors (IIA). (2017). Core Principles for the Professional Practice of Internal Auditing.

Principle: "Is insightful, proactive, and future-focused." Providing advice on the cost-benefit of controls demonstrates insight into the organization's operations and helps management make better decisions about resource allocation for control activities.

3. Pickett, K. H. S. (2011). The Internal Auditing Handbook (3rd ed.). John Wiley & Sons.

Chapter 4, Section 4.5.2, "Responsibility for Internal Control": This chapter clarifies the distinct roles, stating, "Management is responsible for internal control... The internal auditor’s role is to carry out an independent appraisal of the internal control system..." This appraisal includes assessing if controls are cost-effective. (Specific reference to cost-benefit analysis is a recurring theme in discussions of control efficiency).