Final answer:
During a formal consulting engagement, substantial risk exposures or material control weaknesses are brought to the attention of management, as well as the concerns of the internal auditor are communicated to the Board of Directors, the Audit Committee, and Executive Management.
Step-by-step explanation:
In a formal consulting engagement, if substantial risk exposures or material control weaknesses are discovered, they are brought to the attention of management. In some situations, the concerns of the internal auditor are also communicated to all of the above: the Board of Directors, the Audit Committee, and Executive Management.
When substantial risk exposures or material control weaknesses are discovered during a formal consulting engagement, these concerns must be adequately communicated to key parties responsible for corporate governance. The internal auditor should bring these concerns to the attention of executive management, who are responsible for the day-to-day running of the company. Additionally, the concerns should also be communicated to the audit committee, which is a subset of the board of directors created to focus on issues related to the financial reporting and internal control systems.