An internal audit team has completed fieldwork on a payroll controls engagement at Nyra Health Group and identified several low-risk process weaknesses and one high-risk control gap that could permit duplicate payments. The chief audit executive wants the final communication to be effective for both operational managers and the audit committee. Which approach best meets this need?
- AIssue a single detailed report listing every observation in the order it was found, so no stakeholder can claim an issue was omitted.
- BSend only the high-risk finding to the audit committee and withhold the low-risk weaknesses entirely, since minor items may distract governance.
- CProvide an executive summary highlighting the high-risk gap and overall opinion for the audit committee, with detailed findings and action owners for operational management. Correct
- DPresent all findings verbally at a single combined meeting and skip the written report entirely, to save preparation time and encourage open discussion.
Why A is wrong: Completeness matters, but an undifferentiated list buries the high-risk duplicate-payment gap and forces each audience to sift content that is not relevant to their decisions.
Why B is wrong: Focusing governance on significance is reasonable, but suppressing observations from the complete results undermines accuracy and completeness and can mislead the committee about the control environment.
Why C is correct: Tailoring the format and depth to each audience, while keeping one consistent set of results, lets governance focus on significance and managers act on specifics, which is effective engagement communication.
Why D is wrong: Verbal communication aids dialogue, but omitting a written record leaves no auditable basis for agreed actions, follow-up, or accountability, which effective engagement reporting requires.