An internal audit team is conducting a follow-up on prior audit recommendations. They find that management implemented a compensating control instead of the originally recommended primary control. What should the auditor conclude?
-
A
The recommendation is not closed because the exact control was not implemented
-
B
Assess whether the compensating control adequately mitigates the identified risk
-
C
Require management to implement the original recommendation exactly as written
-
D
Escalate to the audit committee for non-compliance