Quality of the Internal Audit Function

At Calderwood Mutual the chief audit executive has a periodic self-assessment scheduled once each year and wants to add a routine that continuously tracks engagement supervision, conformance issues, and stakeholder feedback as engagements close. A senior auditor argues this new routine simply duplicates the annual self-assessment. How should the chief audit executive characterise the new routine?

• AAs a replacement for the annual periodic self-assessment, since continuous tracking captures the same information more frequently and makes the yearly review redundant.
• BAs a substitute for the external quality assessment, because measuring conformance in real time removes the need for an outside assessor.
• CAs ongoing monitoring that runs continuously as part of day-to-day supervision and complements, rather than duplicates, the periodic self-assessment.check_circle Correct
• DAs an informal management courtesy with no role in the quality assurance and improvement program, useful only if time permits after mandatory reviews.

Why A is wrong: It is tempting to fold one into the other, but ongoing monitoring and periodic self-assessment are distinct components of the programme, and continuous tracking is not designed to replace the broader periodic review.

Why B is wrong: Internal monitoring, however frequent, can never substitute for an independent external assessment; the two answer different questions and one cannot stand in for the other.

Why C is correct: Ongoing monitoring is the continuous, embedded component built into routine supervision and review, and it works alongside the periodic self-assessment rather than repeating it, so the two are complementary.

Why D is wrong: Ongoing monitoring is a required element of the programme, not an optional extra, so treating it as a discretionary courtesy understates its role.

Rossmore Bank is shortlisting external assessors for its internal audit quality assessment. One candidate is fully independent but has only ever audited manufacturing functions and has no financial services or internal audit assessment experience. The chief audit executive must weigh this against the independence requirement. What is the most appropriate consideration?

• AIndependence alone qualifies the candidate, so financial services and assessment experience are irrelevant to the appointment decision.
• BThe candidate should be appointed and paired with an internal staff member from Rossmore Bank to supply the missing subject expertise during fieldwork.
• CThe assessor must be both independent and competent, so the chief audit executive should confirm relevant assessment competence before appointing this candidate.check_circle Correct
• DCompetence is the only real requirement, so the chief audit executive should drop the independence condition and hire an experienced in-house reviewer instead.

Why A is wrong: Independence is necessary but not sufficient; a valid external assessment also demands an assessor competent in the practice of internal auditing and the external assessment process.

Why B is wrong: Injecting an internal staff member to fill the competence gap compromises the assessment's independence, trading one required quality for another.

Why C is correct: A valid external assessment rests on two pillars, independence and competence; an independent assessor who lacks the relevant assessment experience does not meet the competence pillar, so that gap must be resolved first.

Why D is wrong: Abandoning independence to secure experience defeats the purpose of an external assessment; both qualities are required, and neither can be waived to obtain the other.

At Draymoor Council the chief audit executive reports functionally to the audit committee and administratively to the chief financial officer. An internal assessment reveals a nonconformance that limits the function's overall independence and coverage. The chief financial officer asks the chief audit executive to route the disclosure through the finance function first and let finance decide what reaches the audit committee. How should the chief audit executive proceed?

• ACommunicate the nonconformance and its impact directly to the audit committee as well as to senior management, preserving the functional reporting line to the board.check_circle Correct
• BAgree to route the disclosure through the chief financial officer, since the administrative reporting line makes finance the proper gatekeeper for what reaches the committee.
• CWithhold the disclosure until the next scheduled committee meeting and raise it verbally there, avoiding a formal record that could complicate the finance relationship.
• DDisclose only to the chief financial officer, treating senior management as sufficient because the nonconformance arose within a finance-overseen function.

Why A is correct: The chief audit executive's functional reporting line to the board means a scope-affecting nonconformance must reach senior management and the board directly, not be filtered through the administrative line to finance.

Why B is wrong: It is tempting because an administrative line exists, but letting finance gate what the committee sees confuses the administrative relationship with the functional reporting line that the disclosure must follow.

Why C is wrong: It is tempting because timing to a set meeting feels orderly, but withholding a function-level nonconformance and reducing it to an unrecorded remark weakens the board's oversight of a matter it is entitled to receive.

Why D is wrong: It is tempting because senior management is a valid recipient, but stopping at the chief financial officer omits the board, to whom disclosure of a scope-affecting nonconformance is also owed.

During ongoing monitoring at Ravenhill Group, the chief audit executive identifies a single engagement where a required supervisory sign-off was missed, corrects the gap on that engagement, and confirms the lapse did not affect the function's overall coverage or its ability to deliver its plan. A junior auditor assumes this must now be disclosed as a nonconformance to the board. How should the chief audit executive characterise the disclosure obligation here?

• ABoard disclosure is required immediately, because any departure from the standards, however minor or isolated, must be reported to the board as a nonconformance.
• BBoard disclosure is not required, because mandatory disclosure applies to nonconformance that affects the function's overall scope or operation, which this isolated and corrected lapse does not.check_circle Correct
• CBoard disclosure should be replaced by a note to the external assessor, who will decide at the next external assessment whether the lapse rises to a reportable nonconformance.
• DBoard disclosure is required only after the periodic self-assessment confirms the lapse, so the finding is validated by a formal review before escalation.

Why A is wrong: It is tempting because thoroughness feels safer, but treating every minor departure as a mandatory board disclosure misstates the threshold, which turns on impact to the function's overall scope or operation.

Why B is correct: The disclosure requirement is triggered by nonconformance affecting the function's overall scope or operation; an isolated, remediated engagement-level lapse with no wider impact does not meet that threshold.

Why C is wrong: It is tempting because external assessors judge conformance, but the disclosure decision rests with the chief audit executive against the impact threshold and cannot simply be parked for the external assessor.

Why D is wrong: It is tempting because self-assessment is part of the quality program, but waiting for it invents a precondition that does not exist; the obligation, if any, turns on impact, not on self-assessment timing.