In internal auditing, when assessing the accuracy and completeness of employee time reporting, auditors often use sampling to determine the overall compliance of the process. In this scenario, the internal auditor sampled 30 employee time reports and found 5 incorrect and 4 unsupported reports. This indicates that a majority (21 out of 30) were accurate, suggesting that the organization generally ensures accurate reporting. However, the presence of incorrect and unsupported reports indicates deficiencies that need to be addressed, but do not point to systemic fraud or abuse. Thus, option D accurately reflects the findings by acknowledging both the general accuracy and the instances of errors.
Reference:
The Institute of Internal Auditors (IIA) - Standards for the Professional Practice of Internal Auditing COSO Framework - Control Activities and Monitoring

In the preliminary audit communication, the condition is the most useful item for management to formulate action plans in response to audit recommendations. The condition describes the existing state or issue identified during the audit. It provides a clear and specific description of what is wrong or what needs improvement, which is essential for management to understand the problem and take appropriate corrective actions. While audit objectives, scope, and observation ratings are important, the condition directly points to the area that needs attention and improvement.
References:
* The Institute of Internal Auditors (IIA) Standard 2410 - Criteria for Communicating: "Communications must include the engagement's objectives and scope as well as applicable conclusions, recommendations, and action plans."
* IIA Practice Guide on "Communicating Audit Results"

Section: Volume B

Section: Volume A