An internal auditor is finalizing an audit report on the effectiveness of the organization's overall system of internal control. Several audit tests were performed, and the only issue identified was that the CEO frequently asks employees to make exceptions or bypass the organization's standard written policies and procedures. Which of the following conclusions is most appropriate for the auditor to report?
The appropriate conclusion for the auditor to report is that the system of internal control is not effective. When the CEO, a high-level executive, frequently asks employees to bypass standard written policies and procedures, it constitutes a significant control weakness. This behavior undermines the integrity and reliability of the organization's internal control system, making it ineffective overall.
B is better