Which statement regarding the scope of an IRO report is correct?

Which statement regarding the scope of an IRO report is correct?

• A. The report may address issues beyond those detailed in the CIA.
• B. The report should address issues defined by the auditee casually.
• C. The report should address general findings.
• D. It must specifically address the issues (and only those issues) detailed in the CIA.

Answer: (D)

Scope defines what will be examined and reported, and in an IRO engagement that scope is set by the CIA. The report should focus on those exact issues and nothing beyond them. This keeps the work tightly aligned with what was agreed, makes findings and recommendations relevant and actionable, and avoids drifting into areas that weren’t part of the engagement. If the report tried to address issues outside the CIA or relied on a vague, casual notion of scope, it could misrepresent what was examined and weaken the engagement’s usefulness. So the statement that the report must specifically address the issues and only those issues detailed in the CIA reflects how the scope is supposed to operate.

Scope defines what will be examined and reported, and in an IRO engagement that scope is set by the CIA. The report should focus on those exact issues and nothing beyond them. This keeps the work tightly aligned with what was agreed, makes findings and recommendations relevant and actionable, and avoids drifting into areas that weren’t part of the engagement. If the report tried to address issues outside the CIA or relied on a vague, casual notion of scope, it could misrepresent what was examined and weaken the engagement’s usefulness. So the statement that the report must specifically address the issues and only those issues detailed in the CIA reflects how the scope is supposed to operate.