A compliance manager asks to score residual risk inside the same engagement where they designed the controls under review. Why is that a problem in IRM audit architecture?
Select an answer to reveal the explanation.
Short Explanation
The third line is the independent referee—not the coach grading their own plays. Audit has to assess risk and compliance work with independence, so the same person shouldn’t both design the controls and declare them assured. That’s three-lines architecture.
Full Explanation
A compliance manager scoring residual risk inside the same engagement where they designed the controls under review breaks IRM audit architecture because Audit operates as the third line and must assess risk and compliance activities objectively and independently. Three-lines design forbids the coach from also being the independent referee on the same plays. Civic assurance credibility depends on that separation of design/operate versus independent assess.
Requiring that Audit must always use only external consultants and never internal staff overstates the rule—independence is about role and objectivity, not an absolute ban on internal auditors. Claiming Entity Framework forbids any auditor from reading control records is false; auditors need read access. Claiming continuous monitoring replaces any independent assessment incorrectly retires the third line.
Exam caveat: third-line independence is why designers/operators should not independently assure their own controls in the audit role. Read access is allowed; self-assurance is not.
Operational check: segregate compliance manager duties from audit sign-off roles; if the same human holds both hats historically, remove audit assurance rights on work they attested or designed; document the independence rule in the municipal audit charter.