Question

Management has asked the internal auditor to recommend monitoring controls that management could establish to provide timely oversight of the information systems contract. Which of the following is the least effective monitoring control?

A. Require monthly internal reports summarizing overhead rates used in billings.
B. Randomly investigate selected cost accounts throughout the year to determine that all the expenses are properly charged to the governmental unit.
C. Require monthly reports by the outsourcer of total costs billed and services rendered.
D. Use internal auditors to investigate the appropriateness of costs, as part of a yearly engagement to evaluate the outsourcer.

Answer 1

The least effective monitoring control for management oversight of information systems contracts is the yearly engagement by internal auditors to evaluate the outsourcer, as it may not provide timely detection of issues.

Step-by-step explanation:

Within the context of monitoring controls for management oversight of information systems contracts, the least effective control among the choices provided is to use internal auditors to investigate the appropriateness of costs, as part of a yearly engagement to evaluate the outsourcer.

Monthly internal reports (Option A) and monthly reports by the outsourcer (Option C) provide more frequent oversight and therefore are likely to catch issues more promptly. Periodic and random investigations (Option B) can add unpredictability to the oversight process, which can deter misconduct. However, relying solely on an annual investigation by internal auditors (Option D) could allow issues to go undetected for much of the year and does not ensure the same level of proactive, ongoing monitoring as the other options.