Internal audits are typically performed by which of the following?

Internal audits are typically performed by which of the following?

• A. The external regulatory body
• B. The quality assurance team
• C. The operating department or process owner that owns the technical activities
• D. The IT department

Answer: (C)

Internal audits work best when the people who actually own and run the process conduct them. The operating department or process owner—who is responsible for the technical activities—knows the step-by-step workflow, the controls that are supposed to be in place, and where deviations tend to occur. That hands-on knowledge lets them evaluate whether procedures are being followed, whether controls are effective, and what changes are needed to keep things compliant and efficient. Because they have the most context, they can identify root causes of issues, verify that corrective actions address the real problems, and ensure improvements stick within their area of responsibility. External regulators focus on compliance for certification and may not dive into everyday practice; the IT department is specialized in information technology and might miss non-IT process risks; the quality assurance team can perform audits, but having the process owner audit their own area reinforces accountability and makes findings immediately actionable in the real workflow.

Internal audits work best when the people who actually own and run the process conduct them. The operating department or process owner—who is responsible for the technical activities—knows the step-by-step workflow, the controls that are supposed to be in place, and where deviations tend to occur. That hands-on knowledge lets them evaluate whether procedures are being followed, whether controls are effective, and what changes are needed to keep things compliant and efficient. Because they have the most context, they can identify root causes of issues, verify that corrective actions address the real problems, and ensure improvements stick within their area of responsibility.

External regulators focus on compliance for certification and may not dive into everyday practice; the IT department is specialized in information technology and might miss non-IT process risks; the quality assurance team can perform audits, but having the process owner audit their own area reinforces accountability and makes findings immediately actionable in the real workflow.