The board wants internal audit to provide assurance over whether the organisation's culture supports ethical behaviour and appropriate risk-taking, rather than over any single process or transaction. Which type of assurance engagement does this describe?
- AA culture assurance engagement, because it assesses whether shared values, behaviours, and attitudes support the organisation's objectives and ethical conduct. Correct
- BA compliance audit, because it checks whether employees have signed and acknowledged the individual clauses of the published code of conduct.
- CA reporting assurance engagement, because it tests whether the organisation's external disclosures fairly present its financial position.
- DAn advisory engagement, because internal audit is being asked to coach management on how to improve the organisation's culture.
Why A is correct: Correct: culture assurance evaluates the organisation's shared values and behaviours and how they shape ethical conduct and risk-taking, which is what the board requested.
Why B is wrong: Confirming acknowledgements is conformance work, which makes compliance tempting, but culture assurance looks at shared behaviours and attitudes rather than whether a form was signed.
Why C is wrong: Reporting assurance addresses the fairness of disclosures, a neighbouring assurance type, so it is tempting but wrong because culture is about behaviour rather than reported information.
Why D is wrong: The board is seeking an independent conclusion on culture, which is assurance work, so framing it as requested coaching mistakes an assurance engagement for advisory support.