During an engagement, an internal auditor discovered that an organizations policy on delegation of authority listed six individuals who were no longer employed with the organization. In addition, four individuals acting with disbursement authority were not identified in the policy as having such authority. Which of the following is the most effective course of action to address the control weakness?
The most effective course of action to address the control weakness is to recommend that management review the process supporting the policy and make improvements. This approach allows management to comprehensively address the underlying issues with the policy rather than simply updating names, ensuring the policy is robust and reflective of current practices to prevent future discrepancies. Additionally, it aligns with the internal auditor's role of assessing and improving the organization's operations and control processes.
I think because auditors cannot advise management to add or remove things to/from procedures. Auditors are responsible for assessing the procedures. In this situation, auditor noted procedure is not showing the current process (condition is outside set criteria). Due to this fact, recommendation was shared with management to look at the process and correct it.
Why note C?