An internal auditor is performing an internal control assessment at a manufacturing company. The auditor observed that the accounts payable clerks…

Comprehensive and Detailed Step-by-Step Explanation:

Reference to Internal Control Assessment:

Standard 2130 - Control: Internal auditors must evaluate the adequacy and effectiveness of controls

in mitigating risks.

COSO Framework: Proper segregation of duties is essential for preventing unauthorized transactions

and fraud.

Reasoning:

Option B is correct because the lack of management review and approval for creating vendors

indicates a control weakness, as it creates opportunities for unauthorized vendors or fraud. The

auditor should investigate whether mitigating controls exist (e.g., periodic review of vendor lists) or

recommend redesigning the process to include managerial oversight.

Option A dismisses the observation without considering its impact on control adequacy. Prompt

payment alone does not address risks related to unauthorized vendors.

Option C incorrectly assumes the observation reflects adequate controls, which is not the case given

the lack of management approval.

Actionable Next Steps:

Document the observation as a control deficiency.

Perform additional testing to identify whether compensating controls mitigate the risk or

recommend enhancements to strengthen controls.