Certified Internal Auditor (CIA) Part 2: Practice of Internal Auditing — Question 169

An organization has a mature control environment but limited internal audit resources. Given this scenario, on which of the following should the internal auditors focus their testing?

Answer options

• A. Detective compensating controls.
• B. Preventive compensating controls.
• C. Detective key controls.
• D. Preventive key controls.

Correct answer: D

Explanation

Internal auditors should concentrate on Preventive key controls because these controls are essential in preventing errors or fraud before they occur, which is crucial in a limited resource environment. Detective controls, whether compensating or key, only identify issues after they have happened, which is less effective in a scenario with limited resources.