Reporting Irregularities to External Authorities
Short answer
A Obtain approval from audit management to submit the report.
Question
Key Takeaways
This tests the auditor's reporting hierarchy and independence; the trap is believing the auditor acts alone or needs the auditee's permission to report non-compliance.
When auditee management ignores irregularities requiring external reporting, the auditor must escalate to audit management to ensure compliance without auditee interference.
Common mistake: Choosing options B or C is incorrect because the auditor should never ask the auditee (who is ignoring the issue) for permission to report them.
Expert Analysis
Why the Answer Is Correct
ISACA standards dictate that the auditor reports to senior management or the audit committee. When external reporting is mandated, the auditor must get authorization from their own chain (audit management) to proceed, ensuring the report is accurate and the process is sound.
Why the Other Options Are Wrong
Options B and C involve asking the auditee for approval, which creates a conflict of interest since they are ignoring the issue. Option D suggests acting immediately without internal verification, which bypasses standard audit governance protocols unless specific laws dictate otherwise.
Community Comment Notes
Comment [1] correctly identifies that the auditee must not block reporting. Comment [2] argues for immediate reporting (D), but exam protocols usually prioritize the internal audit chain of command to validate the finding before external release.
Official Reference
https://www.isaca.org/credentialing/cisa
This link opens the official vendor documentation in a new tab.
Exam Strategy
Always look for the option that maintains auditor independence and follows the reporting hierarchy. Never select an option that gives the auditee veto power over external reporting of significant irregularities.
Community Votes
75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
marc4354345 👍 3 Answered AIf reporting to external authorities is required then the auditee must not be able to block reporting.
-
Sibsankar 👍 1It will be C The BEST action for the IS auditor, when irregularities are found and reporting to external authorities is required, is to obtain approval from both audit and auditee management to release the report. This approach ensures that there is a consensus and understanding between the audit team and the auditee management before taking any action. It helps maintain transparency and allows for a coordinated response.
-
Swallows 👍 1 Answered DIf wrongdoing occurs and is ignored by auditee management, they are legally and ethically responsible to report it. They are expected to report such serious issues to regulators as soon as possible. Auditors have a duty to act independently and to report the truth. They are expected to report issues immediately, without seeking approval from auditees or management.
-
Sibsankar 👍 1Sorry for the earlier response in C. The accurate answer will be D
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All CISA Questions
Access 400 questions with complete answers and detailed explanations.
View Full CISA Practice Test →