The board of a large organisation wants assurance that the internal audit function's external assessment obligation under its quality assurance and improvement program is being met correctly. Which approach satisfies that obligation?
- AEither a full external assessment or a self-assessment with independent external validation, conducted at least once every five years by a qualified reviewer from outside the organisation. Correct
- BOnly a full external assessment performed every year by a reviewer who is employed elsewhere within the same organisation but outside the audit team.
- CA periodic self-assessment signed off by the chief audit executive alone, provided that the function repeats the exercise at least every three years.
- DOngoing monitoring supplemented by a stakeholder survey, provided that senior management approves the scope of the review beforehand.
Why A is correct: This is correct: the obligation may be met by a full external assessment or by a validated self-assessment, performed at least every five years by a qualified, independent outside reviewer.
Why B is wrong: An annual cadence is stricter than required and a reviewer from inside the same organisation is not independent of it, so this fails the independence expectation.
Why C is wrong: A self-assessment without independent external validation is an internal activity; the chief audit executive's sign-off does not supply the external independence the obligation requires.
Why D is wrong: Ongoing monitoring and surveys are internal in nature and do not deliver an independent external judgement, so management approval of scope does not turn them into an external assessment.