What is the correct action when a significant control issue is found during a consulting engagement?

The correct action when a significant control issue is found during a consulting engagement is to inform senior management and the Board. This approach underscores the importance of transparency and ensures that leaders who are responsible for governance and risk management are made aware of critical issues that could impact the organization’s operations or compliance.

Senior management and the Board have the authority and responsibility to make strategic decisions based on the information provided to them. By notifying them of significant control issues, internal auditors enable timely and effective decision-making to mitigate risks and implement necessary changes.

Additionally, involving senior leadership and the Board fosters a culture of accountability and demonstrates the internal audit function's value in addressing risks early, rather than allowing unchecked issues to escalate.

In contrast to this correct action, documenting the issue alone would fail to take the necessary steps for resolution and lacks the urgency needed for significant issues. Notifying the entire audit team might lead to unnecessary discussions without escalation to decision-makers who can take immediate action. Similarly, addressing the issue during the next meeting would delay the resolution process and may allow the risks associated with the control issue to persist, potentially harming the organization.