Question

A newly appointed chief audit executive (CAE) at a financial services firm discovers that internal audit—positioned as the third line—has been asked by the CFO to design and implement the remediation controls for deficiencies audit itself identified in the payment reconciliation process. The CFO argues this is efficient because internal audit understands the gaps best. What should the CAE recommend to preserve the integrity of the three lines of defense model?

Accepted Answer

Decline the design and implementation role, keeping remediation with first-line management while internal audit independently assesses the fix

Answer

Accept the assignment but disclose the involvement in the next audit report to maintain transparency

Answer

Have the second-line risk function approve internal audit's control designs before implementation to add oversight

Answer

Rotate the audit staff who identified the deficiencies off the remediation team so different auditors build the controls