An internal control questionnaire (ICQ) is a commonly used tool in the assessment of entity-level controls. It is a structured set of questions that auditors use to gather information about the controls in place within an organization. However, while this method can be efficient for gathering broad-based information, it has certain limitations, one of the most significant being that the information obtained can be repudiated.

Repudiation refers to the possibility that the information provided by respondents can be denied or questioned later. This is a key drawback because the responses in an ICQ are typically self-reported and may not be fully accurate or reliable. Respondents may either misunderstand the questions or provide answers that are overly optimistic, biased, or not fully truthful. This can compromise the reliability of the evidence gathered through this method.

IIA References:

According to IIA's International Professional Practices Framework (IPPF), particularly in the Implementation Guides that accompany the Standards, internal auditors are encouraged to use various techniques for gathering evidence to ensure the completeness, accuracy, and reliability of the information. The guide cautions that self-reported data, such as that obtained through questionnaires, should be corroborated with additional evidence.

IIA Standard 2310: Identifying Information states that internal auditors must identify sufficient, reliable, relevant, and useful information to achieve the engagement’s objectives. The limitations of the ICQ, particularly the risk of repudiation, directly relate to the reliability of the information obtained.

Additionally, the IIA’s Practice Guide on Evaluating Internal Controls suggests that while ICQs are useful in gaining an initial understanding of control environments, they should not be relied upon as the sole source of evidence. This emphasizes the need for corroborative evidence to address the risk of repudiation.

Given these considerations, the correct answer is A. Information obtained by this method can be repudiated because the self-reported nature of ICQs inherently carries the risk of repudiation, thus questioning the reliability of the control assessment finding