Management at Calloway Retail submits an action plan in response to a finding that customer refunds were processed without authorisation. The plan commits to reversing the specific unauthorised refunds the engagement already identified. The chief audit executive reviews the plan. What should the chief audit executive conclude?
- AThe plan is adequate, because it remediates the specific exceptions that the engagement identified during fieldwork.
- BThe plan should be rejected and replaced with the auditor's own remediation steps, since management's proposed response is incomplete.
- CThe plan addresses the symptom but not the cause, because it corrects the known instances without preventing further unauthorised refunds from occurring. Correct
- DThe plan should be accepted on condition that management commits to a follow-up audit, because re-auditing will confirm that the refunds were reversed.
Why A is wrong: Tempting because the plan does fix what was found, but adequacy requires treating the cause so the issue does not recur, which this plan does not do.
Why B is wrong: Tempting because the plan is deficient, but substituting the auditor's own steps takes over management's ownership of the response rather than flagging the gap for management to close.
Why C is correct: Correct: reversing the identified refunds treats the observed exceptions, yet it leaves the authorisation control gap that allowed them, so the plan misses the root cause.
Why D is wrong: Tempting because follow-up is legitimate, but a later audit that confirms reversals still does not treat the authorisation weakness, so accepting the plan on that basis misses the cause.