Who should receive audit results when findings involve supervisors, senior management, or the board?

Question

AcadiFi · Accepted Answer

Audit results should go to parties who can ensure corrective action and who need the information to fulfill oversight duties. Routine issues may stay with local management and the process owner, but significant control failures, fraud indicators, or matters affecting risk appetite often require communication to senior management or the board. The more serious and organization-wide the issue, the higher the reporting level.

Assume Summit Harbor Bank audits user-access controls and finds 14 terminated employees still active after more than 30 days, including 3 with privileged access. The branch operations manager should receive the specific control deficiency because that team owns the remediation. Senior management should receive the issue if the problem reflects a broader access-governance weakness. If the deficiency is severe, repeated, or tied to unacceptable risk exposure, the audit committee may also need a summary. The right answer is rarely everyone gets everything; it is about relevance, responsibility, and severity.

A strong CIA shortcut is to ask who can fix it and who must know about it. Fix-it authority points to management. Oversight responsibility points to senior leadership or the board. If an answer choice bypasses management on a routine issue or hides a serious governance problem at a low level, it is usually wrong. Practice more in our CIA question bank.

Who should receive audit results when findings involve supervisors, senior management, or the board?

Master Part 2 with our CIA Course

Related Questions

Practice Questions