Engagement Results and Monitoring

At Kingsmere Logistics an operations director has formally accepted a supply-chain risk that the chief audit executive judges could exceed the organisation's risk appetite. What should the chief audit executive do first?

• ADiscuss the matter with senior management to seek resolution before considering whether further escalation is warranted.check_circle Correct
• BRecord the accepted risk in the engagement file and treat the matter as closed, because deciding to accept risk is a management responsibility.
• CReport the accepted risk straight to the external auditors so an independent party can challenge the operations director's decision.
• DInstruct the operations director to withdraw the acceptance and implement the audit recommendation without further discussion.

Why A is correct: Correct, because the process begins with the chief audit executive raising the concern with senior management, giving them the chance to resolve it before the board is involved.

Why B is wrong: Tempting because the decision to accept risk does rest with management, but the chief audit executive still has a duty to act when the accepted level may be unacceptable to the organisation, so simply filing it abandons that duty.

Why C is wrong: Tempting because independent challenge sounds rigorous, but the communication process is internal, running from senior management to the board, so routing it to the external auditors misdirects the escalation.

Why D is wrong: Tempting because the recommendation may be sound, but the chief audit executive cannot overrule a management risk decision, so issuing an instruction oversteps the advisory role.

During an engagement at Wexbridge Council, the internal auditors could not examine a key third-party contract because the provider withheld its records, and this restricted the work on procurement controls. The lead auditor proposes issuing an unqualified report and raising the access problem verbally with management. How should the chief audit executive respond?

• ARequire the report to disclose the scope limitation, identifying the records that could not be examined and its effect on the conclusions about procurement controls.check_circle Correct
• BApprove the verbal approach, since the withheld records are an operational dispute between management and the provider rather than an audit reporting matter.
• CHold the conclusions back and delay the report until the provider releases the withheld records, however long that takes.
• DIssue the report with the procurement controls section removed, so that no unsupported conclusion on that area is presented to readers.

Why A is correct: Correct: the withheld records restricted the work, so the communication should disclose the scope limitation and its effect on the procurement conclusions, allowing readers to judge the reduced coverage.

Why B is wrong: It is tempting to see the access dispute as management's problem, but a restriction that limited the audit work is a scope limitation the communication should disclose, not something to settle informally off the record.

Why C is wrong: Waiting for the records is understandable, but an open-ended delay withholds useful results from stakeholders when the better course is to disclose the limitation and report what the work supports.

Why D is wrong: Deleting the section avoids an overstated conclusion, but it also hides that a planned area went unexamined, whereas disclosing the limitation keeps the reader informed about what was and was not covered.

After distributing the final engagement communication for a procurement review at Halton Foods, the chief audit executive discovers that a significant figure in one finding was overstated because of a data extraction error. Several recipients have already acted on the report. What should the chief audit executive do?

• ANote the error informally to the process owner and correct it in the next scheduled engagement report.
• BWait until the annual quality assessment to record the error as a lesson learned.
• CReissue the report to the audit committee alone, since it holds ultimate oversight of the finding.
• DCommunicate the corrected information to the parties who received the original communication.check_circle Correct

Why A is wrong: This feels efficient because it avoids reissuing a document, but it leaves the recipients who already acted holding inaccurate figures, so it fails the accuracy attribute.

Why B is wrong: Logging the mistake for the quality programme is reasonable later, but treating a live inaccuracy as a process lesson delays the correction recipients need now, which misapplies the accuracy attribute.

Why C is wrong: The audit committee does oversee findings, but correcting only that body leaves other recipients who relied on the flawed figure uninformed, so the accuracy correction is incomplete.

Why D is correct: When a released communication contains a significant error, the accuracy attribute requires the chief audit executive to issue corrected information to the recipients who received the original, so decisions rest on reliable data.

At Ravensworth Bank the audit team finds that three payment batches were released without the required second approval. The line manager offers to reinstate the missed approvals and re-train the two clerks involved. The chief audit executive judges this response addresses the visible errors but not why the approval step was bypassed. What should the recommendation focus on?

• AThe individual clerks' errors, recommending disciplinary follow-up so that the specific people responsible for the missed approvals are held accountable.
• BThe three affected batches, recommending that each be reprocessed with the second approval applied retrospectively to clear the exceptions.
• CThe reason the approval step could be skipped, recommending a change so the system enforces the second approval before a batch can be released.check_circle Correct
• DWider transaction testing, recommending that the audit team expand its sample to quantify how many other batches were affected before a corrective fix is proposed.

Why A is wrong: Targeting the clerks feels decisive, but it treats the surface incidents and named individuals rather than the systemic reason the control could be bypassed at all.

Why B is wrong: Reprocessing corrects the observed symptoms, but once the batches are cleared the same gap remains open, so the underlying weakness will recur.

Why C is correct: Correct because addressing the root cause, the ability to release a batch without the second approval, prevents recurrence, whereas fixing only the three batches or the clerks leaves the control still bypassable.

Why D is wrong: More testing may size the problem, but extending the sample measures the symptom's spread rather than addressing the cause, and it defers the corrective recommendation the finding already supports.

A final engagement communication reports a loss figure that ties exactly to the ledger, but the surrounding narrative repeatedly describes the process owner as negligent and careless. The figures are correct. Which attribute of effective communication is most at risk?

• AAccuracy, because the emotive language means the underlying figures cannot be relied upon by the reader.
• BObjectivity, because the wording is not fair or impartial and shapes how the reader judges the process owner.check_circle Correct
• CClarity, because the emotional tone makes the message harder for the reader to understand and follow.
• DConciseness, because the blaming narrative adds length that the reader does not strictly need.

Why A is wrong: Tempting because harsh tone can feel like distortion, but the figures tie to the ledger and are free from error, so accuracy is satisfied.

Why B is correct: The data reconciles, so content is not the problem; objectivity requires fair, impartial and undistorted wording, and loaded blame breaches it.

Why C is wrong: Tempting because tone affects reading, but the message can still be understood; clarity concerns comprehension and structure, not fairness of tone.

Why D is wrong: Tempting because the narrative is wordy, but conciseness addresses redundancy, and the core defect here is biased framing rather than length.