A company wants to review its own processes and management reporting to determine whether they are effective and efficient in meeting regulatory requirements, industry needs, and organizational strategy. Which audit type most closely matches this purpose?

### Why this is right The described purpose matches the course definition of an internal audit: examining organizational processes, controls, and management reporting for effectiveness and efficiency in meeting requirements and strategy. The question does not describe an independent professional issuing an external opinion. ### The concept An internal audit reviews the organization’s own processes and controls in relation to regulatory requirements, industry needs, and organizational strategy. An external audit is described as a systematic process conducted by a competent and independent professional, including evidence analysis and a written opinion. Both involve evaluation, but their roles and independence differ. ### The other options - **B. External audit**: this is tempting because it also evaluates controls, but the scenario specifically describes the internal-audit purpose and does not specify an independent external professional. - **C. Cybersecurity assessment only**: an assessment evaluates assets, threats, vulnerabilities, risks, and controls; it does not capture the stated internal-audit definition. - **D. A technical control with no review process**: a control is something an audit may examine, not the organizational review described. ### Terms - **Management reporting**: Information prepared for organizational decision-makers about activities, performance, or controls. - **Internal audit**: An examination of organizational processes, controls, and reporting against requirements and strategy. ### Remember When the focus is the organization’s own processes and their effectiveness against strategy and requirements, identify the internal audit.