The audit committee chair has asked your boss, the CAE, to explore the possibility of giving an overall annual opinion each year on the organization’s state of internal controls. The CAE has done some preliminary research and designed the following potential form for such an opinion:

To: Chair, Audit Committee

From: Executive VP - Internal Audit

Subject: Internal Audit Opinion of the System of Internal Controls for the Period Ended December 31, 20XX. We have completed the annual internal audit plan for the company. This plan was designed in such a manner that allows us to assess the adequacy of the company’s system of internal controls relating to operational risks, financial reporting risks, and compliance risks. The plan was prepared considering the results of the risk assessment completed as a part of the company’s enterprise risk management process and the risk assessments completed by internal audit and the organization’s external auditors. Our work was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing. The criteria used to assess the company’s system of internal controls are reflected in the company’s internal control framework, which is based on the COSO internal control framework. The criteria were discussed and agreed upon with management of each area before the individual engagements included in the annual internal audit plan were conducted. Our overall opinion is that on December 31, 20XX, internal controls over operations, financial reporting, and compliance are designed adequately and operating effectively. We have conducted sufficient appropriate audit procedures and gathered the necessary evidence to support this conclusion. The evidence gathered meets professional internal audit standards and is sufficient to provide reasonable assurance. The CAE has asked you to do additional research regarding the appropriateness of internal audit functions giving such opinions and to develop a preliminary list of issues that the department would need to consider if it were to give such an opinion. He suggests that you might begin by reviewing The IIA Practice Guide “Formulating and Expressing Internal Audit Opinions.”

a. Is the type of opinion the CAE is considering to the audit committee positive or negative assurance? Explain.

b. What does this opinion imply about the scope of internal audit work performed?

c. In your report to the CAE, what factors would you recommend the internal audit function consider before committing to issuing an overall opinion on the organization’s system of internal controls?