Reported internal audit observations emerge as a result of comparing “what should be” with “what is.” In determining “what should be” during an internal audit engagement, which of the following would be the least appropriate criterion against which to assess current controls?
a. Industry best practices.
b. Control policies and procedures prescribed by senior management.
c. A standard of control effectiveness determined by the internal audit function.
d. The controls documented as being in place during the last audit.