At Kelsington Mutual the chief audit executive concludes, following an internal assessment, that a persistent shortage of resources has left several assurance engagements unperformed and has narrowed the internal audit function's overall coverage. The chief audit executive judges that this nonconformance affects the function's overall scope and operation. To whom must the chief audit executive disclose the nonconformance and its impact?
- ATo senior management and the board, together with the impact of the nonconformance on the function's overall scope and operation. Correct
- BTo the external quality assessor at the next external assessment, so an independent party can validate the finding before it is escalated further.
- CTo the audit committee chair informally, keeping the matter off the formal record until resourcing is resolved so the report is not prematurely alarming.
- DTo operational line management responsible for the underfunded areas, so the resource gap can be corrected before any wider communication is made.
Why A is correct: When nonconformance affects the overall scope or operation of the internal audit function, the standards require the chief audit executive to disclose both the nonconformance and its impact to senior management and the board.
Why B is wrong: It is tempting because external assessors do evaluate conformance, but it wrongly defers a required current-year disclosure and treats the assessor as the primary recipient rather than senior management and the board.
Why C is wrong: It is tempting because a quiet word feels proportionate, but an informal aside is not the required disclosure and withholding it from the formal record undermines the board's oversight of the function.
Why D is wrong: It is tempting because line management controls some resources, but disclosure of function-wide nonconformance is owed to senior management and the board, not routed to the managers whose areas went unaudited.