A senior auditor distinguishes between the findings recorded during an engagement and the overall engagement conclusion. Which statement best captures what an engagement conclusion is, as distinct from the individual findings that support it?
- AIt is a detailed list of every observed control deficiency together with the sample sizes and test steps used to detect each one.
- BIt is management's formal action plan committing to remediate each deficiency by an agreed date and responsible owner.
- CIt is a statement of absolute assurance that no material control weaknesses exist anywhere in the process under review.
- DIt is an overall professional judgement about the engagement objectives, drawing on the aggregated findings to state how well the area meets the applicable criteria. Correct
Why A is wrong: Tempting because such detail belongs in the results, but that catalogue describes the findings and supporting evidence, not the higher-level judgement the conclusion expresses.
Why B is wrong: Tempting because plans accompany reports, but remediation commitments are management's response; the auditor's conclusion is an independent professional judgement, not management's plan.
Why C is wrong: Tempting because stakeholders want certainty, but internal audit provides reasonable, not absolute, assurance; claiming a guarantee misstates what a conclusion can offer.
Why D is correct: The conclusion is the auditor's summarising judgement against the engagement objectives and criteria, synthesising the findings rather than merely listing them.