The city auditor reviews security control evidence for a public-works system, while a state regulator later conducts a formal examination of the same environment. Which statement best distinguishes these activities?
Select an answer to reveal the explanation.
Short Explanation
Your own referee versus the league office—both check the game film, but only one can bench you from outside. Internal audit isn’t the same as a regulator’s exam.
Full Explanation
An internal compliance audit by the city auditor and an external regulatory examination of the same public-works environment are related but not identical. Internal audit provides independent assurance within the municipal governance structure, reporting typically to an audit committee or equivalent, and helps management improve controls. A state regulator’s examination carries outside authority, often mandatory participation, and potential enforcement consequences that internal findings alone do not create.
Treating both as identical external regulatory examinations with the same legal compulsion collapses internal governance into state power—an inaccurate framing. Claiming the city auditor’s review is always illegal if a regulator might examine later invents a conflict; internal audit commonly prepares organizations for external scrutiny and is a healthy practice. Asserting that external examinations never review security and that only internal auditors may look at controls is false; regulators frequently examine cybersecurity for critical or regulated systems.
Exam caveat: SY0-701 distinguishes internal audits from external regulatory examinations by authority, compulsion, and audience. Do not equate them or ban internal work because external exams may follow.
Operational check: track internal audit findings to closure with management owners, and maintain an evidence repository that can be reused for regulator fieldwork. Brief executives on which issues are governance improvements versus those that could become regulatory findings if left open.