An organization's internal audit scope is restricted exclusively to testing financial and accounting controls. From a compliance and ethics perspective, what is the primary weakness of this audit strategy?
Select an answer to reveal the explanation.
Short Explanation
Check this out: if your internal audit only tests financial controls, you're missing the non-financial risks that blow up compliance programs. Bribery, human rights, and data privacy issues won't show up in balanced ledgers. You need audit coverage for those operational and compliance risks too.
Full Explanation
An effective compliance program must feature an audit plan that covers all high-risk areas of the business. While financial audits ensure the integrity of financial statements and detect financial statement fraud, they do not assess compliance with operational, environmental, social, or human-rights regulations. Focusing solely on financial controls creates major compliance vulnerability. Significant non-financial risks, including Foreign Corrupt Practices Act behavioral violations, General Data Protection Regulation breaches, and environmental or labor law infractions, will go unchecked because standard financial audits do not monitor these areas. The correct choice is the one that says the audit leaves the organization exposed by failing to evaluate compliance and operational risks such as anti-corruption, human rights, and data privacy. The choice claiming the audit process becomes excessively complex and difficult for the internal audit team to execute is incorrect because limiting the scope to financial controls actually simplifies the audit process, though it exposes the company to unmitigated risk. The choice saying the audit is simplified to the point where it fails to satisfy basic external financial auditing standards is incorrect because audits focused on financial controls are designed specifically to meet external financial standards, such as Sarbanes-Oxley Act compliance, and are highly effective for that purpose; its weakness is failure to address broader compliance and ethics risks. The choice saying the audit significantly increases direct financial cost by requiring specialized accounting personnel is incorrect because restricting the scope to financial auditing typically lowers the cost by avoiding the need to hire specialized operational or compliance auditors. To ensure comprehensive risk mitigation, internal audit plans must coordinate with the compliance department to audit controls across both financial and non-financial risk areas.