The chief audit executive at Ravenshill Group is preparing the annual communication to the board on the overall effectiveness of the internal audit function. A junior analyst suggests the report should simply list the number of engagements completed during the year. What should the annual communication to the board most appropriately convey?
- AA count of completed engagements and the total hours charged, so the board can benchmark productivity against the prior year.
- BAn assessment of internal audit's performance relative to its plan and objectives, together with significant risk and control issues and conformance with professional requirements. Correct
- CA detailed transcript of every management response received during the year so the board can review each disagreement in full.
- DA summary confined to the two or three engagements that produced the most favourable results for management this year.
Why A is wrong: Activity counts are tempting because they are easy to compile and look objective, but volume metrics alone say nothing about whether the function achieved its objectives, covered key risks, or conformed with professional requirements.
Why B is correct: An effective annual communication reports the function's performance against its plan and objectives, the significant risk and control matters identified, and its conformance status, giving the board what it needs to judge overall effectiveness.
Why C is wrong: This appears thorough, but flooding the board with raw responses obscures the overall picture; the annual communication should synthesise effectiveness and significant matters, not reproduce every engagement exchange.
Why D is wrong: Highlighting favourable outcomes is tempting for reputational reasons, but a selective good-news summary distorts the assessment and withholds the significant risk and control issues the board relies on.