Internal audit offers to take over the security team's continuous monitoring of key controls, arguing that its independence would make the results more reliable. How should the security manager respond?
Select an answer to reveal the explanation.
Short Explanation
Internal audit is the referee; if the referee starts playing for one of the teams, nobody trusts the calls anymore. Monitoring belongs to management, and you want audit staying independent so it can tell the board whether that monitoring actually works. The trap is an argument that sounds like more independence but actually destroys it.
Full Explanation
In the three lines model, operational management owns and operates controls as the first line, functions such as information security and risk management provide expertise, monitoring and challenge as the second line, and internal audit provides independent assurance to the board as the third line. Continuous control monitoring is a management activity. If internal audit performs it, audit would later be assessing work it had done itself, which impairs its objectivity and removes the independent view the board relies on. The security manager should therefore decline while welcoming audit's assurance work over the monitoring process. Accepting the offer outright, even with the reasoning about reliability, trades long-term assurance for a short-term gain and leaves the organization without independent evaluation of those controls. Accepting it for only the high-risk controls is worse in a way, because those are exactly the controls where independent assurance matters most. Transferring control ownership to audit combines operation, monitoring and assurance in one function, eliminating segregation entirely. Exam caveat: internal audit may advise on control design or monitoring approaches as a consulting activity, provided it does not assume management responsibility. Operational check: confirm the audit charter and the security function's responsibilities define distinct roles for monitoring and assurance.