CompTIA Security+ (SY0-701)Security Program Management and OversightHard
An organization's internal audit team reviews financial controls each quarter, while an outside CPA firm independently reviews the same controls annually and issues a report to the board and external stakeholders. What is the primary advantage of the external audit compared to the internal audit?
- AIt provides independent, unbiased assurance to external stakeholders
- BIt replaces the need for any internal control monitoring
- CIt is performed more frequently and catches issues faster
- DIt has full access to make changes to the controls being tested
Show answer & explanationAnswer & explanation
Correct answer: A. It provides independent, unbiased assurance to external stakeholders
External audits are conducted by independent third parties with no organizational bias, providing credible, objective assurance to external stakeholders such as investors, regulators, or customers. Internal audits, while valuable for continuous self-monitoring, lack this independence.
Why the other options are wrong
- B. External audits complement, not replace, ongoing internal monitoring.
- C. The scenario states the external audit is annual, less frequent than the quarterly internal audit.
- D. Auditors, internal or external, assess controls but do not typically implement changes themselves.
Internal vs. External Audit
Internal audits are performed by an organization's own staff for continuous self-assessment, while external audits are performed by independent third parties to provide unbiased assurance to outside stakeholders.
- Internal audits are typically more frequent and operational in focus
- External audits provide independence and credibility to regulators/investors
- Both are components of a mature governance and oversight program
Memory trick: Internal checks yourself; external checks are checked by someone else.