CIA-1 - Governance, Risk Management, and Control (30% of the exam) - Section C.3
Recognize ethical and compliance-related issues, including the ethical, legal, and compliance requirements applicable to an organization and the internal auditor's role in the organization's ethical framework.
Identify the ethical, legal, and regulatory compliance requirements that apply to an organisation and recognise where breaches create risk. Describe the internal auditor's role within the organisation's ethical framework, including assessing whether governance supports ethical conduct and whether mechanisms exist to raise and address ethical concerns.
Compliance requirementsEthical frameworkCode of conduct
Practice question for this objective
lock_openFree sampleGovernance, Risk Management, and Controlmedium
During a governance engagement at Harwell Foods, the internal auditor confirms that the organisation has a written code of conduct, but finds no confidential channel through which staff can report suspected ethical breaches and no evidence that anyone monitors adherence to the code. What should the auditor do?
ADesign and launch a confidential reporting channel for staff, because internal audit is trusted and well placed to run such a mechanism.
BReport that the ethical framework lacks a means to raise and monitor concerns, a gap that weakens governance over ethical conduct in the organisation.check_circle Correct
CConclude that the ethical framework is sound because a written code of conduct is in place, and close the engagement without further work.
DRefer the code to human resources for wording improvements and defer any conclusion on the ethical framework to a later engagement.
Internal audit assesses whether mechanisms exist to raise and monitor ethics concerns and reports gaps, rather than building the mechanism itself. A code of conduct with no reporting channel and no monitoring cannot show that ethical conduct is supported in practice. Internal audit's role in the ethical framework is to assess these mechanisms and report weaknesses, so identifying the gap is correct while owning or excusing it is not.
Why A is wrong: Building and operating the channel looks helpful, but owning a mechanism that internal audit should later assess takes on a management responsibility and impairs its independence.
Why B is correct: Internal audit's role is to assess whether governance supports ethical conduct and whether mechanisms exist to raise and address concerns, so reporting this evidenced gap is the appropriate action.
Why C is wrong: The existence of a code is tempting evidence of a framework, but a document alone does not show that concerns can be raised or that adherence is monitored, so the conclusion is unsupported.
Why D is wrong: Polishing the wording sounds constructive, but it addresses the wrong issue and postpones reporting a real governance gap the current engagement has already evidenced.
Exam traps in Governance, Risk Management, and Control
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-1 bank for this domain.
Draft the company's data-protection policies and determine which legal duties apply to each unit, since internal audit has studied the new law in detail.
errorWhy it is wrong: It is tempting because the auditors understand the law, but owning policy design and defining the organisation's compliance obligations is a management and second-line responsibility that would impair internal audit's later assurance.
A code of conduct is an assurance report that internal audit issues each year to confirm the entire workforce has behaved ethically throughout.
errorWhy it is wrong: This confuses a governance document with an audit output; internal audit reports on the framework's effectiveness but does not certify that every employee behaved ethically.
Internal audit should own the ethics programme and take responsibility for enforcing the code of conduct across the whole workforce.
errorWhy it is wrong: This is tempting because internal audit understands the framework well, but owning and enforcing the programme would make internal audit a first line activity it could no longer assure objectively.