Which of the following is not an appropriate role for internal auditors after a disaster occurs?
Which of the following is not an appropriate role for internal auditors after a disaster occurs?
Internal auditors should not correct deficiencies of the entity's business continuity plan after a disaster. This task is a management responsibility, as it involves making operational decisions and implementing changes to processes. Internal auditors are responsible for monitoring the effectiveness of recovery efforts, recommending future improvements, and assisting in identifying lessons learned, but they should not directly correct deficiencies.
key word here is "correct the BCP deficiencies" is actually a management function which the IA should not do.
management responsibility to correct