Prior to performing testing an internal auditor has determined that a primary process control failed due to design weakness. Which of the following actions should the auditor perform next?
Correct Answer: A
When an internal auditor identifies a primary control failure due to a design weakness, the next step is to assess the risk and determine if there are any compensating controls that mitigate this risk. Compensating controls can help to reduce the overall risk to an acceptable level. Engaging with management to discuss the issue and determine the necessary corrective actions ensures that the control environment is adequately addressed. This approach aligns with the internal auditor's role in providing assurance and consulting services designed to add value and improve an organization's operations.
Reference: The IIA's International Standards for the Professional Practice of Internal Auditing, Standard 2120 - Risk Management.