Internal audit functions as the third line of defense, providing independent assurance to the board and senior management. A critical part of this role is to assess the overall effectiveness of the institution's risk management framework. Therefore, when identifying material issues and their root causes, the audit report must include a determination of how effectively the first line (front line units) and second line (independent risk management) are performing their respective duties in identifying, managing, and resolving such issues in a timely manner.

A. "End result for the organizational unit" is vague and not standard terminology for an audit finding; the focus is on control effectiveness and risk management.

B. An audit assesses effectiveness against established criteria, not a subjective list of "pros and cons" for a specific function.

D. An audit report does not contain a self-assessment of its own credibility; credibility is established through the quality and independence of the audit work.

1. ACAMS. (2023). CAMS Risk Management (CAMS-RM) Study Guide. Chapter 2: Risk Governance. (Explains the role of Internal Audit as the third line, responsible for providing independent assurance on the effectiveness of the first two lines).

2. The Institute of Internal Auditors. (2017). International Standards for the Professional Practice of Internal Auditing (Standards). Standard 2120: Risk Management. (States that the internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes).

3. Basel Committee on Banking Supervision. (2012). The internal audit function in banks. Bank for International Settlements. Paragraph 23, p. 8. (Specifies that the internal audit function should assess the effectiveness of the risk management function).