Management requested the chief audit executive (CAE) to include an audit of the organization's health and safety program in next year's annual audit plan.
However, the internal audit department has no expertise in this area. Which of the following would be the most appropriate action by the CAE?
When management requests an audit in an area where the internal audit department lacks expertise, the most appropriate action by the chief audit executive (CAE) is to meet with management to explain that the audit cannot be undertaken and to discuss alternative strategies. This is to ensure that the audit maintains its integrity and effectiveness. It is crucial for the internal audit to have the necessary expertise to conduct a thorough and accurate audit. Developing internal audit capabilities in the required area or suggesting alternative ways to address the health and safety concerns would be the most prudent approach.
why not c
This would not be the consulting engagement as it is just a request from the management to include the review in the audit plan. IA cannot agree with management that if something is not comfortable for IA then certain processes are excluded from the engagement because IA don't have specialists within the department or entire IA lack knowledge in the certain topic.
why not A
Assurance must be given regarding the containment of health and safety risk. In addition, management's expectations must be met.