Auditing, Risk, Governance and Ethical Quality

Introduction and strategic context

Quality management is not limited to inspecting products or correcting process defects. In a mature organisation, quality is a system of accountability through which leaders identify uncertainty, establish controls, verify performance, protect interested parties, and learn from evidence. Auditing, risk management, governance and ethical conduct therefore form an integrated part of total quality management (TQM).

An internal audit asks whether the organisation’s arrangements are suitable, implemented and effective. Risk management asks what could prevent objectives from being achieved, what opportunities may be missed, and how uncertainty should be treated. Governance establishes who has authority, who is accountable, how decisions are challenged, and how performance is reported. Ethical quality ensures that conformity is not achieved through deception, unsafe shortcuts, discrimination, concealment or abuse of information.

This chapter focuses on conducting risk-based internal audits, managing nonconformities and corrective actions, supporting management review, and addressing accountability, compliance, product safety, data integrity, ethics and sustainability. The emphasis is strategic: an audit should help decision-makers protect customers and other stakeholders while improving organisational capability.

Learning objectives

By the end of this chapter, the learner should be able to:

1. Explain the relationship between auditing, risk, governance and ethical quality.
2. Plan and conduct a risk-based internal audit using objective evidence.
3. Distinguish audit criteria, evidence, findings, observations and nonconformities.
4. Analyse causes and verify the effectiveness of corrective action.
5. Explain how management review converts quality information into decisions.
6. Evaluate accountability, compliance, product safety, data integrity, ethics and sustainability risks.
7. Judge the limitations of audit programmes and design practical improvements.

1. Foundations of quality auditing

An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which audit criteria are fulfilled. The definition has three important implications.

First, an audit is systematic. It is planned, conducted according to a defined method, and recorded sufficiently to support conclusions. Second, it requires independence and impartiality. An auditor should not audit work for which they are directly responsible, unless the organisation is very small and compensating safeguards are applied. Third, conclusions must be based on evidence rather than personal preference.

Audit criteria, scope and evidence

Audit criteria are the requirements against which evidence is evaluated. They may include a quality-management standard, legislation, customer specifications, internal procedures, contractual commitments, safety requirements, approved designs or ethical policies.

Audit scope defines the organisational units, processes, locations, products, period and interfaces covered. A vague scope produces vague conclusions. For example, “audit production quality” is weaker than “evaluate control of final inspection, release records and nonconforming product in Line 2 during the previous quarter.”

Objective evidence consists of records, statements of fact or other information relevant to the criteria and verifiable. Examples include calibration records, training evidence, production data, interviews, direct observation, system logs, customer complaints and samples of released products. A single interview statement may indicate a lead, but important conclusions normally require corroboration.

Audit evidence is commonly evaluated through sampling. Because an auditor rarely examines every transaction, the sample must be selected rationally. Random sampling can reduce selection bias; risk-based sampling gives greater attention to high-impact, unusual or recently changed activities. Sampling does not prove that every item conforms. It supports a conclusion about the sampled evidence and the effectiveness of the control system.

Audit principles

The principal behaviours expected of competent auditors are:

• Integrity: acting honestly, responsibly and professionally.
• Fair presentation: reporting significant obstacles, disagreements and unresolved issues accurately.
• Due professional care: applying judgement proportionate to the importance of the task.
• Confidentiality: protecting sensitive commercial, personal and technical information.
• Independence: avoiding bias and conflicts of interest.
• Evidence-based approach: reaching conclusions that are reproducible from available evidence.
• Risk-based approach: focusing attention on matters significant to objectives and stakeholders.

These principles are not ceremonial. For example, an auditor who suppresses an inconvenient finding damages governance even if the audit report appears positive.

2. Risk-based internal auditing

A traditional compliance audit may treat every clause as equally important. A risk-based audit instead asks which failures could most seriously affect customers, safety, legal compliance, strategic objectives, finances, reputation or the reliability of information. It still considers mandatory requirements, but allocates audit effort according to risk and control significance.

Risk concepts

Risk is commonly understood as the effect of uncertainty on objectives. An effect may be negative, positive or both. A threat may cause harm; an opportunity may improve performance. Risk should therefore not be reduced to a list of hazards. It includes uncertainty about demand, suppliers, technology, data, regulatory change, competence, climate, cyber-security and organisational behaviour.

Important distinctions include:

• Inherent risk: exposure before controls are considered.
• Control: a measure that maintains, changes or removes risk.
• Residual risk: exposure remaining after controls operate.
• Risk owner: the person accountable for managing a particular risk.
• Risk appetite: the amount and type of risk an organisation is willing to pursue or retain.
• Risk tolerance: acceptable variation around an objective or limit.
• Risk treatment: avoiding, reducing, transferring, sharing or accepting risk.

A simple prioritisation score can be useful, provided its limitations are recognised:

Here, R is the risk score, L is the likelihood score and I is the impact score. The scores must be defined consistently, for example from 1 to 5, and the organisation must specify how score bands influence action. The multiplication model assumes that the chosen scales are meaningful and that a high likelihood with moderate impact can be compared sensibly with low likelihood and very high impact. It is a screening aid, not a probability law. A catastrophic safety event should not automatically be treated as equivalent to a frequent minor paperwork error merely because both produce the same numerical score.

Where controls are being assessed, a useful conceptual relationship is:

This is not a universal numerical equation because risk dimensions may not be additive. It is a reasoning model: auditors should identify the original exposure, examine the control design and operation, and judge what remains.

Designing the audit programme

An annual or rolling audit programme should consider:

1. Legal, regulatory and customer obligations.
2. Product and process safety.
3. Previous nonconformities and overdue actions.
4. Process performance and complaint trends.
5. Significant changes in people, technology, suppliers or facilities.
6. Criticality of outsourced processes.
7. Results of management review.
8. Strategic objectives and organisational risks.
9. Auditor competence and independence.
10. Available resources and appropriate audit frequency.

High-risk processes may require frequent audits, layered process audits or continuous monitoring. Low-risk administrative processes may require less frequent but still proportionate review. A programme should be dynamic: a serious incident, regulatory change or major process modification may justify an unscheduled audit.

The audit lifecycle

#### Initiation and planning

The audit leader confirms purpose, criteria, scope, timing, team competence, methods, confidentiality requirements and reporting arrangements. The team reviews relevant procedures, previous findings, performance data, complaints, incidents and risk registers. A process-based audit plan follows the flow of work rather than merely the structure of a standard.

For example, an audit of order fulfilment may trace one customer order through contract review, planning, purchasing, production, inspection, release, delivery and complaint handling. This reveals interfaces where responsibility is often unclear.

#### Opening meeting

The opening meeting confirms objectives, introduces the team, explains methods, verifies access to records and identifies operational constraints. It should establish cooperation without compromising independence. Auditors should explain that an audit evaluates processes and controls, not the personal worth of employees.

#### Collecting and evaluating evidence

Auditors use interviews, observation, document review, data analysis and tracing of samples. Effective questions are open, neutral and connected to the process: “How do you know this revision is current?” or “Show me how a rejected item is identified and prevented from unintended use.” The auditor compares what should happen with what actually happens.

Evidence should be recorded contemporaneously. Useful notes identify the requirement, sample or transaction, observed fact, source and significance. Personal judgements such as “the operator seemed careless” are not evidence. A defensible note states, for example, “three of ten sampled inspection records lacked the required equipment identification.”

#### Findings and conclusions

A conformity exists when the requirement is fulfilled. A nonconformity exists when a requirement is not fulfilled. An observation or opportunity for improvement may identify a weakness or possible enhancement that does not constitute failure against a criterion. Organisations should define how such categories are used so that observations do not become a way of hiding genuine nonconformities.

Findings should be clear, factual and traceable. A useful structure is:

• criterion or requirement;
• objective evidence;
• statement of the gap;
• consequence or risk, where relevant.

A finding should not exaggerate beyond the evidence. If two records out of a sample are incomplete, the report should not claim that all records are incomplete unless additional evidence supports that conclusion.

#### Closing meeting and report

The closing meeting presents findings, explains the basis for conclusions, allows factual clarification, and confirms the process for corrective action. Disagreement should be recorded and resolved through evidence, not rank. The report normally includes scope, criteria, team, dates, summary conclusion, positive practices, findings, evidence, risks and required follow-up.

#### Follow-up

Audit value is realised after the report. Follow-up determines whether actions were implemented and whether they addressed the cause. Closure should not be granted merely because a revised procedure was issued. The auditor should examine implementation and results.

3. Nonconformity and corrective action

A nonconformity is a failure to meet a requirement. It may concern a product, process, system, record, legal obligation or customer commitment. Effective response has several distinct stages.

Immediate correction and containment

Correction addresses the detected problem, such as re-inspecting affected units, correcting a record or replacing an incorrect label. Containment prevents further escape or harm, such as stopping shipment, quarantining stock, notifying customers or temporarily increasing inspection. These actions manage the present condition but do not necessarily prevent recurrence.

Cause analysis

Corrective action addresses cause or causes. A disciplined analysis distinguishes:

• the observed failure;
• the direct or technical cause;
• contributing conditions;
• systemic or management-system causes.

The “five whys” technique can help with simple causal chains, but it should not be used mechanically. Complex failures may involve interactions among design, workload, training, incentives, supplier controls, software configuration and leadership decisions. Fishbone analysis, fault-tree analysis, process mapping, barrier analysis and structured investigation are alternatives.

A weak cause statement is “operator did not follow procedure.” A stronger analysis asks why the procedure was not followed: Was it available and understandable? Was the required tool usable? Did production incentives conflict with quality? Was competence verified? Did supervisors detect the deviation? Was the procedure itself valid?

Corrective-action effectiveness

A corrective-action record should identify the issue, containment, cause, action owner, due date, affected processes, required resources, evidence of completion and effectiveness criteria. Effectiveness may be shown by stable performance over an appropriate period, absence of recurrence, improved capability, successful re-audit or objective evidence that the risk has been reduced.

A closed action is not necessarily an effective action. For example, retraining may be completed while the error continues because the real cause is an ambiguous interface or poorly designed software screen. Auditors should test whether the control changed and whether outcomes improved.

4. Governance, accountability and management review

Governance is the system by which an organisation is directed, controlled and held accountable. Quality governance connects strategic purpose with operational controls. It clarifies authority, escalation, assurance and consequences.

Accountability architecture

A sound quality governance structure typically includes:

• governing body or senior leadership oversight;
• an accountable executive for quality and safety;
• process owners with defined authority and resources;
• independent or suitably objective assurance;
• reporting channels for employees and other stakeholders;
• escalation rules for serious risks and incidents;
• documented decisions and follow-up.

Responsibility may be delegated; accountability cannot be transferred merely by writing a procedure. Senior leaders remain accountable for ensuring that the system is adequately resourced and that commercial pressure does not override safety, legality or truthful reporting.

A responsibility assignment matrix can clarify roles. The commonly used categories are Responsible for doing the work, Accountable for the final decision, Consulted for input and Informed for communication. Each important activity should normally have one clearly accountable role, even if several people are responsible.

Management review as a decision process

Management review should be more than a presentation of metrics. It is a structured evaluation of whether the quality management system remains suitable, adequate and effective, and whether changes are needed. Inputs may include:

• status of actions from previous reviews;
• changes in internal and external issues;
• customer satisfaction and stakeholder feedback;
• process performance and product conformity;
• nonconformities and corrective actions;
• audit results;
• supplier and outsourced-process performance;
• adequacy of resources;
• effectiveness of actions addressing risks and opportunities;
• opportunities for improvement;
• safety, compliance, ethical and sustainability indicators.

Outputs should include decisions and actions concerning improvement, system changes, resources, objectives, risk treatment and escalation. Minutes should record owners and due dates, not merely attendance and discussion topics. A useful review links information to decisions: “Supplier defect trend exceeded the control limit; qualify an alternative supplier and increase incoming verification until capability is demonstrated.”

5. Compliance, product safety and data integrity

Compliance as a minimum boundary

Compliance means meeting applicable legal, regulatory, contractual and internal requirements. Compliance is necessary but not sufficient for quality. A product may be legal yet unreliable; a process may satisfy a document requirement yet fail customers. Organisations should maintain an obligation register identifying requirements, owners, evidence, review dates and consequences of breach.

Compliance audits should examine how requirements are translated into operational controls. They should also consider regulatory change, permits, competence, records, reporting duties and interactions with contractors. Legal interpretation may require specialist advice; auditors should not present unsupported legal opinions.

Product and service safety

Safety-critical quality requires a precautionary mindset. Controls may include hazard analysis, design review, validation, traceability, supplier qualification, process controls, release authority, complaint investigation, recall planning and incident reporting. The severity of potential harm should influence audit depth even when the likelihood appears low.

Safety information must be escalated promptly. Concealing a defect, delaying a report to protect sales figures or releasing a product without authorised disposition is a governance failure, not merely a procedural error. Where safety and commercial objectives conflict, protection of users and compliance obligations take precedence.

Data integrity

Data integrity means that information remains complete, consistent, accurate, attributable, legible, contemporaneous, original or a reliable true copy, and available throughout its retention period. Controls should address access rights, authentication, segregation of duties, version control, audit trails, backup, retention, change management and secure disposal.

A spreadsheet can be a quality record even if it is not part of a formal database. Auditors should examine whether formulas are protected, changes are traceable, source data are retained, shared accounts are prohibited where inappropriate, and review is independent of data creation. Artificially altering timestamps, deleting failed results or selectively reporting favourable results violates data integrity and ethical quality.

6. Ethical quality and sustainability

Ethical quality concerns how results are achieved, not only whether targets are met. Relevant principles include honesty, respect, fairness, non-maleficence, transparency, confidentiality, responsible stewardship and respect for human rights.

Common ethical risks include:

• falsifying inspection or audit records;
• suppressing complaints or safety information;
• retaliation against whistleblowers;
• conflicts of interest in supplier selection;
• discriminatory treatment of workers or customers;
• misuse of personal data;
• misleading sustainability claims;
• coercive or unsafe labour practices in the supply chain;
• rewarding output while ignoring quality escapes.

An ethical quality system provides confidential reporting channels, protection against retaliation, proportionate investigation, conflict-of-interest declarations and leadership modelling. A code of conduct is ineffective if incentives reward concealment.

Sustainability expands quality thinking across the life cycle. Audits may examine resource use, waste, emissions, product durability, repairability, responsible sourcing, worker welfare and community impact. Sustainability claims should be supported by defined boundaries, reliable data and transparent assumptions. A claim that a product is “carbon neutral,” for example, requires clarity about scope, measurement, reduction and offsetting; vague claims create reputational and ethical risk.

7. Technology and AI in audit and assurance

Digital tools can improve audit planning by analysing complaints, process trends, access logs, supplier performance and corrective-action ageing. Continuous auditing can identify unusual transactions or control failures earlier than periodic audits. However, automated detection does not eliminate professional judgement.

AI-supported tools introduce risks of biased training data, opaque recommendations, privacy breaches, fabricated summaries and excessive reliance on automated classifications. An auditor remains responsible for validating outputs, preserving evidence and explaining conclusions. Sensitive data should be minimised, access-controlled and processed under applicable privacy and information-security requirements. AI should support—not replace—independent challenge, ethical reasoning and accountability.

8. Illustrative case: Northbridge Medical Devices

The following is a fictional illustrative case.

Background

Northbridge Medical Devices manufactures a disposable fluid-control component. Customer complaints about intermittent leakage increased over three months, but the complaint dashboard showed the rate as stable. Internal audit was scheduled because a new sealing machine had been installed and a major supplier had changed its polymer formulation.

Problem

The audit team traced ten complaint records to the production and data systems. Three complaints had been coded as “transport damage” without technical evaluation. The final inspection plan required a seal-strength test, but records for the first two weeks after installation contained manually entered results with identical values. Interviews revealed that production supervisors could edit test results after the shift. The calibration record for the new tester was complete, but method validation had not been approved.

The immediate product risk was potential leakage. The governance risk was more serious: performance information had been distorted, and responsibility for release decisions was unclear.

Analysis

The team separated correction from cause analysis. Containment included stopping shipment from the affected period, identifying retained samples, notifying the regulatory liaison and performing a validated test on stock. A causal investigation found several interacting causes:

1. The machine installation plan did not require quality approval before routine release.
2. The electronic system permitted uncontrolled editing and did not preserve an adequate audit trail.
3. Supervisors were measured primarily on output and were not trained in data-integrity expectations.
4. Complaint coding had no second-level technical review.
5. Management review examined complaint counts but not coding changes or unusual data patterns.

Approach and solution

Northbridge assigned a senior quality executive as accountable owner and created a cross-functional investigation team independent of production. It validated the test method, restricted editing rights, enabled an audit trail, required documented justification for corrections, and introduced independent review of complaint classifications. The company requalified the sealing process, reassessed the supplier change, retrained relevant staff, and revised the change-control procedure so that process validation preceded release.

The audit programme was changed to include risk-based audits after major equipment or material changes. Management review received a dashboard showing complaint severity, reclassification rates, data corrections, overdue actions and safety escalations. A protected reporting channel was communicated to employees.

Outcome

Retained-stock testing identified a limited affected batch, which was controlled before further distribution. In the following quarter, complaint reporting initially increased because under-reporting was corrected; thereafter, validated leakage results declined and data corrections became traceable. The organisation did not claim success solely because training was completed. It verified effectiveness through record sampling, system-log review, process testing and a follow-up audit.

Learning points

The case demonstrates that an audit finding may reveal a governance failure rather than an isolated operator mistake. Product safety, data integrity, change management, incentives and management review were interconnected. A risk-based audit followed the product and information flows, while ethical quality required truthful escalation even when the short-term performance indicators worsened.

9. Challenges and limitations

Auditing has limitations. Samples can miss rare failures; records can be staged; interviewees may fear consequences; auditors can suffer confirmation bias; and risk scores can create false precision. A low audit finding rate may indicate strong control, weak auditing or a culture of concealment. Organisations should therefore use multiple assurance sources: audits, process indicators, complaints, incident data, employee voice, supplier information and independent review.

Risk-based prioritisation can also neglect low-frequency catastrophic events if numerical scoring is used mechanically. Critical safety and legal controls require explicit treatment regardless of their calculated score. Similarly, compliance checklists may produce superficial conformity if they are disconnected from outcomes.

Independence is difficult where audit staff report to the managers they audit. Smaller organisations may use cross-functional reviews, external auditors, peer audits or rotating auditors as safeguards. Confidentiality must be balanced with escalation: information suggesting imminent harm, fraud or legal breach cannot be hidden merely because it was obtained in confidence.

10. Best-practice implementation guidance

A mature organisation should:

1. Maintain a current risk and obligation profile linked to processes and objectives.
2. Use an approved, risk-based audit programme that can change when conditions change.
3. Train auditors in evidence evaluation, interviewing, process thinking, ethics and data protection.
4. Define finding categories and escalation thresholds clearly.
5. Separate correction, containment, cause analysis and corrective action.
6. Assign one accountable owner and realistic due dates for significant actions.
7. Verify effectiveness using outcome evidence rather than paperwork alone.
8. Ensure management review produces decisions, resources and escalation.
9. Protect product safety, truthful reporting and whistleblowing from commercial pressure.
10. Govern digital and AI tools through validation, access control, human review and auditability.
11. Integrate sustainability and human-rights considerations into supplier and lifecycle assurance.
12. Measure audit effectiveness by reduced exposure, improved process capability and better decisions—not by the number of audits completed.

Chapter Summary

Auditing, risk, governance and ethical quality are mutually reinforcing elements of advanced TQM. A risk-based internal audit directs attention to processes and controls that matter most to objectives, stakeholders, safety and compliance. Its conclusions must be based on objective, traceable evidence and communicated fairly. Nonconformity management requires immediate correction and containment, but lasting improvement depends on credible cause analysis and verified corrective-action effectiveness.

Governance clarifies authority, accountability, escalation and assurance. Management review should transform audit results, process performance, complaints, supplier information, risks and ethical indicators into documented decisions and resources. Compliance establishes a minimum boundary, while product safety and data integrity demand stronger controls and truthful reporting. Ethical quality addresses the means as well as the results, and sustainability extends responsibility across the product and supply-chain life cycle. Technology and AI can strengthen assurance, but human judgement, independence and accountability remain essential.

Key Terms

Audit criteria: Requirements used as the reference for evaluating audit evidence.

Audit evidence: Verifiable information relevant to audit criteria.

Audit scope: Boundaries and extent of an audit.

Risk-based auditing: Allocating audit attention according to significance and uncertainty.

Inherent risk: Exposure before controls are applied.

Residual risk: Exposure remaining after controls operate.

Risk owner: Person accountable for managing a specified risk.

Control: Measure that maintains, changes or removes risk.

Nonconformity: Failure to fulfil a requirement.

Correction: Action to eliminate a detected nonconformity.

Containment: Action limiting the effects or spread of a problem.

Corrective action: Action to eliminate the cause of a nonconformity and prevent recurrence.

Objective evidence: Information that is factual and verifiable.

Management review: Leadership evaluation of the suitability, adequacy and effectiveness of the quality system.

Governance: System through which an organisation is directed, controlled and held accountable.

Data integrity: Maintenance of complete, consistent, accurate and trustworthy data throughout its lifecycle.

Product safety: Protection of users and other stakeholders from unacceptable product-related harm.

Ethical quality: Achievement of quality objectives through honest, fair, responsible and respectful conduct.

Risk appetite: Amount and type of risk an organisation is willing to pursue or retain.

Effectiveness verification: Evaluation of whether an action achieved its intended result.

Review Questions

Short Answer Questions

1. What is the difference between audit criteria and audit scope?
2. Distinguish correction, containment and corrective action.
3. Why is objective evidence essential in an internal audit?
4. What is residual risk?
5. Identify four important inputs to management review.

Long Answer Questions

1. Explain the complete lifecycle of a risk-based internal audit, from planning through follow-up.
2. Discuss how governance and accountability influence quality performance.
3. Explain how an organisation should investigate and verify the effectiveness of corrective action.
4. Analyse the relationship between compliance, product safety and ethical quality.
5. Evaluate the opportunities and limitations of AI-supported auditing.

Analytical / Application Questions

1. A factory has repeated label errors, but management responds only by retraining operators. Analyse possible systemic causes and propose a risk-based corrective-action plan.
2. An auditor discovers that employees can alter inspection results without an audit trail. Identify the safety, governance and data-integrity risks, and recommend immediate and long-term actions.
3. Design a management-review dashboard for a high-risk outsourced process. Justify the indicators, escalation thresholds and evidence needed to assess effectiveness.

Multiple Choice Questions with Answers

Question 1

Which feature most directly distinguishes a risk-based internal audit from a purely checklist-based audit?

A. It allocates greater attention to significant threats to objectives and stakeholders.

B. It examines only financial records.

C. It avoids reviewing legal requirements.

D. It eliminates the need for audit evidence.

Correct Answer: A. It allocates greater attention to significant threats to objectives and stakeholders.

Question 2

Which statement best describes containment?

A. It permanently eliminates the systemic cause.

B. It limits the effects or spread of a detected problem.

C. It verifies the competence of the auditor.

D. It approves the annual audit programme.

Correct Answer: B. It limits the effects or spread of a detected problem.

Question 3

In the screening model R = L × I, what do L and I represent?

A. Leadership and inspection

B. Likelihood and impact

C. Loss and investment

D. Legality and independence

Correct Answer: B. Likelihood and impact

Question 4

Which is the strongest audit finding statement?

A. The operator appeared careless.

B. The department has a poor attitude to quality.

C. Three of ten sampled inspection records lacked the required equipment identification.

D. Management should improve everything.

Correct Answer: C. Three of ten sampled inspection records lacked the required equipment identification.

Question 5

What is the principal purpose of management review?

A. To record attendance at a quality meeting

B. To evaluate the system and make decisions about improvement, resources and risks

C. To replace all internal audits

D. To approve employee holidays

Correct Answer: B. To evaluate the system and make decisions about improvement, resources and risks

Question 6

Which action is most directly associated with data integrity?

A. Allowing shared user accounts for convenience

B. Deleting failed test results after retesting

C. Maintaining attributable records and traceable changes

D. Reporting only favourable performance trends

Correct Answer: C. Maintaining attributable records and traceable changes

Question 7

Why is retraining alone often an inadequate corrective action?

A. Training is never relevant to quality.

B. The underlying cause may involve system design, incentives, resources or unclear procedures.

C. Retraining automatically creates a nonconformity.

D. Auditors are prohibited from reviewing training records.

Correct Answer: B. The underlying cause may involve system design, incentives, resources or unclear procedures.

Question 8

Which governance arrangement provides the clearest accountability?

A. Several departments share accountability without an assigned owner.

B. One accountable owner is assigned, with responsibilities and escalation routes defined.

C. Only external auditors may make decisions.

D. Employees are accountable for risks they cannot control.

Correct Answer: B. One accountable owner is assigned, with responsibilities and escalation routes defined.

Question 9

Which ethical practice is most appropriate when a possible product-safety issue is discovered?

A. Delay escalation until sales targets are achieved.

B. Suppress the issue if the probability appears low.

C. Escalate promptly, contain potential harm and preserve truthful evidence.

D. Change the complaint classification to reduce the reported rate.

Correct Answer: C. Escalate promptly, contain potential harm and preserve truthful evidence.

Question 10

Which statement about AI-supported auditing is correct?

A. AI outputs require no human validation.

B. AI removes the need for auditor independence.

C. AI can assist analysis, but auditors remain responsible for validating outputs and conclusions.

D. AI may freely process sensitive data without governance controls.

Correct Answer: C. AI can assist analysis, but auditors remain responsible for validating outputs and conclusions.