Internal Control, Audit, Ethics, and Financial Governance

Introduction and Context

Healthcare organizations manage unusually complex financial systems. They receive payments from patients, insurers, governments, donors, and employers; purchase clinical supplies and sophisticated equipment; employ highly specialized staff; and process sensitive health and financial information. Financial failure may therefore harm not only profitability but also patient safety, service continuity, institutional reputation, and public trust.

Internal control, audit, ethics, and financial governance provide the framework through which healthcare organizations protect resources, produce reliable information, comply with law, and pursue their mission responsibly. These subjects are interconnected. Internal controls operate within daily processes; internal and external audits evaluate whether controls and reporting are reliable; ethical principles guide conduct when rules are incomplete; and governance bodies provide oversight and accountability.

A sound control system does not seek to eliminate all risk. Healthcare organizations must accept some risk to innovate, expand access, and respond to emergencies. The objective is to identify risks, reduce them to an acceptable level, and ensure that significant decisions are transparent and accountable.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain the purpose and components of internal control in healthcare.
2. Design controls for cash, procurement, payroll, inventory, billing, claims, and revenue cycles.
3. Apply segregation of duties and risk-based control principles.
4. Distinguish internal audit, external audit, compliance review, and investigation.
5. Assess fraud, cybersecurity, privacy, and financial reporting risks.
6. Evaluate ethical and fiduciary responsibilities in healthcare finance.
7. Explain the role of boards, audit committees, executives, and control owners.
8. Recommend improvements using monitoring, data analytics, and evidence-based governance.

1. The Nature and Purpose of Internal Control

Internal control is a process designed and operated by the board, management, and employees to provide reasonable assurance regarding:

• effectiveness and efficiency of operations;
• reliability of financial and operational reporting;
• safeguarding of assets; and
• compliance with laws, regulations, contracts, and policies.

The phrase “reasonable assurance” is important. Controls cannot guarantee that fraud, error, or loss will never occur. Human judgment, collusion, management override, changing technology, and cost constraints limit the effectiveness of every control system.

A widely used framework identifies five interrelated components:

Controls may be preventive, detective, or corrective. A purchase authorization is preventive; a bank reconciliation is detective; recovery of an overpayment and process redesign are corrective. They may also be manual, automated, or hybrid.

Control objectives and control procedures

A control should be linked to a specific risk and objective. For example:

A well-designed control specifies the responsible person, frequency, evidence retained, exception procedure, and escalation route. A vague instruction such as “review invoices carefully” is weaker than “the accounts-payable supervisor reviews and initials a monthly exception report for invoices exceeding the approval threshold.”

2. Risk Assessment and Control Design

Risk assessment begins with identifying events that could prevent the organization from achieving its objectives. A practical risk statement describes the event, cause, and consequence. For example: “A staff member changes supplier bank details without independent verification, causing an unauthorized electronic payment.”

Two common dimensions are likelihood and impact. A simple inherent-risk score can be represented as:

Likelihood and impact are ordinal ratings, such as 1 to 5, rather than monetary measurements. The score is useful for prioritization but is not a probability calculation unless the scale has been explicitly designed as one. Residual risk is the risk remaining after controls operate. Risk assessment should consider both inherent risk and control effectiveness.

Important design principles include:

• Proportionality: high-value, high-volume, or highly sensitive activities require stronger controls.
• Traceability: transactions should be traceable from source document to ledger and report.
• Independence: the person performing a transaction should not control its approval, recording, custody, and reconciliation.
• Least privilege: users receive only the access necessary for their roles.
• Exception orientation: systems should identify unusual transactions for review rather than relying entirely on manual inspection.
• Business continuity: controls must remain effective during outages, disasters, and emergencies.

3. Segregation of Duties

Segregation of duties (SoD) reduces the possibility that one individual can initiate, conceal, and benefit from an improper transaction. Four functions are especially important:

1. Authorization: approving a transaction or access right.
2. Custody: holding cash, inventory, medications, equipment, or credentials.
3. Recording: entering transactions into accounting or operational systems.
4. Reconciliation or review: comparing independent evidence and investigating differences.

In a large hospital, purchasing may authorize a supplier, receiving may confirm delivery, accounts payable may record the liability, treasury may release payment, and accounting may reconcile the bank account. In a small clinic, complete separation may be impractical. Compensating controls could include owner review of bank statements, surprise cash counts, restricted system access, and independent monthly review by an external accountant.

SoD must also address information systems. A user who can create a supplier and release an electronic payment presents a significant conflict, even if different departments nominally perform the tasks. Access reviews should identify incompatible combinations of privileges.

4. Controls Across Major Healthcare Cycles

4.1 Cash and treasury

Cash is highly vulnerable because it is liquid, portable, and difficult to trace after misappropriation. Controls should cover both physical cash and electronic funds.

Key controls include:

• numbered receipts and daily cash collection summaries;
• separation of collection, recording, deposit, and reconciliation;
• prompt deposits and restricted access to cash drawers;
• independent bank reconciliations;
• dual authorization for significant electronic payments;
• verification of supplier bank-account changes through an independent channel;
• review of unusual refunds, voids, transfers, and dormant accounts; and
• documented controls over petty cash and emergency payments.

A bank reconciliation compares the bank statement with the organization’s cash ledger. It identifies timing differences, bank charges, errors, and unauthorized transactions. It should be prepared by someone who does not issue payments and reviewed by a responsible manager.

4.2 Procurement and accounts payable

Procurement risk includes unauthorized purchases, conflicts of interest, duplicate invoices, inflated prices, fictitious suppliers, and purchases outside approved contracts.

A typical procure-to-pay sequence is:

1. Department identifies a need.
2. Authorized employee raises a purchase requisition.
3. Procurement obtains quotations or applies an approved contract.
4. Authorized officer issues a purchase order.
5. Receiving personnel verify quantity and condition.
6. Accounts payable performs a three-way match.
7. Authorized treasury personnel release payment.
8. Accounting records and reconciles the transaction.

The three-way match compares the purchase order, receiving report, and supplier invoice. Exceptions should be investigated rather than automatically overridden. Data analytics can identify duplicate invoice numbers, repeated round-dollar invoices, unusual weekend transactions, purchases just below approval thresholds, and suppliers sharing addresses or bank accounts with employees.

4.3 Payroll and human resources

Payroll controls protect against ghost employees, unauthorized pay rates, excessive overtime, duplicate payments, and payments to terminated employees.

Human resources should authorize hiring, status changes, compensation, and termination. Payroll should process approved information, while department managers verify attendance, shifts, overtime, and leave. Periodic reports should compare the payroll register with the authorized employee master file. Changes to bank accounts and compensation should generate alerts and require independent approval.

Emergency staffing and temporary workers create additional risk. Contracts should specify rates, hours, credentialing requirements, and approval procedures. Payroll analytics can compare overtime by department, employee, shift, and period, but unusual results require contextual investigation rather than automatic accusations.

4.4 Inventory and medical supplies

Healthcare inventory includes pharmaceuticals, implants, laboratory materials, personal protective equipment, food, and general supplies. Risks include theft, expiry, diversion, incorrect valuation, stock-outs, and unrecorded consumption.

Effective controls include:

• restricted storage and access logs;
• perpetual inventory records for high-value or controlled items;
• barcode or radio-frequency identification where appropriate;
• cycle counts based on value and risk;
• segregation of ordering, receiving, issuing, and recording;
• expiry-date monitoring and first-expiry-first-out rotation;
• investigation of quantity variances; and
• documented disposal of expired, damaged, or controlled items.

Inventory accuracy can be expressed as:

The formula assumes that “without discrepancy” has been defined in advance, including an acceptable tolerance. It is a control-performance measure, not a complete measure of inventory effectiveness; an organization may have accurate records but poor availability or excessive expiry.

4.5 Patient billing and revenue cycle

The revenue cycle begins with registration and eligibility verification and continues through documentation, coding, charge capture, claim submission, payment posting, denial management, and collection.

A simplified sequence is:

• register the patient accurately;
• verify payer eligibility and authorization;
• document services in the clinical record;
• translate services into appropriate codes and charges;
• submit complete and timely claims;
• post payments and adjustments accurately;
• reconcile contractual allowances and receivables; and
• pursue denials, underpayments, and patient balances lawfully and compassionately.

Important controls include edit checks for missing data, independent review of high-risk coding, reconciliation of clinical activity to charges, controlled write-offs, review of credit balances, and approval of refunds. Staff should not alter clinical documentation or codes merely to increase reimbursement.

Revenue-cycle performance may be monitored through metrics such as denial rate, clean-claim rate, days in accounts receivable, collection rate, and percentage of unbilled services. Metrics require clear definitions. For example:

The numerator and denominator must refer to the same population and reporting period. A low denial rate is not necessarily good if claims are being withheld or undercoded.

4.6 Claims, compliance, and reimbursement integrity

Healthcare claims may be governed by public insurance rules, private contracts, national coding standards, and anti-fraud laws. Risks include upcoding, unbundling, medically unnecessary services, duplicate billing, billing for services not rendered, improper referrals, and misrepresentation of eligibility.

A strong claims-compliance program combines education, pre-billing edits, post-payment audits, anonymous reporting channels, disciplinary procedures, repayment protocols, and periodic risk assessments. Compliance staff should have sufficient independence and access to senior leadership or the board.

5. Audit and Assurance

An audit is a systematic process of obtaining and evaluating evidence against defined criteria. The criteria may be accounting standards, laws, contracts, internal policies, or management-approved objectives.

Internal audit

Internal audit is an independent and objective assurance and consulting activity designed to add value and improve operations. It evaluates governance, risk management, and control processes. Internal audit may review procurement, revenue integrity, cybersecurity controls, clinical service costing, or major projects.

External audit

An external financial statement audit provides an independent opinion on whether financial statements are prepared, in all material respects, in accordance with an applicable reporting framework. An audit provides reasonable, not absolute, assurance. It does not mean that every transaction has been tested or that all fraud has been detected.

Compliance review and investigation

A compliance review determines whether conduct meets specified legal or policy requirements. An investigation responds to suspected wrongdoing and requires careful preservation of evidence, confidentiality, due process, and protection against retaliation. These activities should not be confused with a routine financial audit.

Audit evidence and materiality

Auditors evaluate evidence for relevance, reliability, sufficiency, and appropriateness. Evidence may include contracts, invoices, confirmations, system logs, observation, interviews, analytical procedures, and recalculation.

Materiality concerns whether a misstatement or omission could influence the decisions of users of financial statements. Materiality is quantitative and qualitative. A small payment may be quantitatively immaterial but qualitatively significant if it indicates bribery, regulatory breach, or executive misconduct.

6. Fraud Risk and Financial Misconduct

The fraud triangle identifies three commonly interacting conditions:

• Pressure or incentive: financial distress, performance targets, or personal benefit;
• Opportunity: weak controls, excessive access, or ineffective oversight; and
• Rationalization: beliefs such as “I am only borrowing it” or “the organization can afford it.”

A fourth dimension, sometimes called capability, emphasizes that the individual must possess the authority, access, skill, or confidence to exploit the opportunity.

Fraud risk assessment should examine procurement conflicts, vendor relationships, payroll anomalies, reimbursement claims, cash refunds, revenue adjustments, and management override. Controls should be supported by a speak-up culture. A hotline is ineffective if reports are ignored or reporters suffer retaliation.

Red flags are indicators, not proof. For example, an employee’s unusual lifestyle, repeated override of controls, or resistance to leave may justify review but should not alone establish misconduct. Investigations must respect fairness, privacy, employment law, and presumption of innocence.

7. Cybersecurity and Technology-Enabled Financial Controls

Financial control is increasingly dependent on electronic health records, enterprise resource planning systems, payment platforms, cloud services, application programming interfaces, and third-party vendors. Cybersecurity is therefore a financial governance issue as well as an information-technology issue.

Core controls include:

• unique user IDs and multifactor authentication;
• role-based access and periodic access recertification;
• privileged-access management;
• encryption of sensitive data in transit and at rest;
• change management and testing before deployment;
• immutable or protected audit logs;
• backup, restoration, and disaster-recovery testing;
• endpoint protection and vulnerability management; and
• vendor due diligence and contractually defined security obligations.

Artificial intelligence and automation can identify anomalies, predict denials, classify invoices, and support continuous auditing. However, automated systems may reproduce biased data, generate false positives, expose confidential information, or make recommendations that cannot be explained. Human review, model governance, access restrictions, validation, and documentation remain necessary.

A control is not effective merely because a system records a log. Management must review the log, define escalation criteria, and demonstrate that exceptions are resolved.

8. Ethics and Fiduciary Responsibility

Financial decisions in healthcare affect vulnerable patients and public resources. Ethical finance therefore requires more than technical compliance. Important principles include:

• Integrity: information and representations are truthful.
• Objectivity: decisions are not distorted by conflicts of interest.
• Confidentiality: financial and health information is protected.
• Competence and due care: professionals maintain knowledge and perform work carefully.
• Fairness: patients, suppliers, employees, and funders are treated consistently.
• Stewardship: resources are used for legitimate organizational and patient purposes.
• Transparency: significant assumptions, risks, and conflicts are disclosed.

Fiduciary responsibility involves acting loyally, prudently, and in the organization’s legitimate interests. Board members should understand that fiduciary duty is not equivalent to maximizing short-term surplus. A financially sustainable healthcare organization must also protect quality, access, safety, equity, and legal compliance.

Conflicts of interest should be disclosed, evaluated, managed, and documented. Recusal may be necessary. Gifts, referral relationships, supplier incentives, executive compensation, related-party transactions, and charitable restrictions deserve particular attention.

9. Governance and Board Oversight

Governance establishes who has authority, how decisions are challenged, and how performance is evaluated. The board is responsible for oversight, while management is responsible for execution. The board should not perform management’s daily work, but it must ask whether management has identified significant risks and designed effective responses.

An audit or finance committee commonly oversees:

• financial reporting and significant accounting judgments;
• external-auditor independence and appointment;
• internal-audit plans and findings;
• compliance and whistleblowing arrangements;
• cybersecurity and technology-related financial risks;
• major litigation, fraud allegations, and related-party transactions; and
• remediation of control deficiencies.

Board reporting should be concise but decision-useful. A dashboard may include cash position, liquidity forecasts, aged receivables, denial trends, procurement exceptions, inventory losses, payroll anomalies, audit findings, cybersecurity incidents, and overdue corrective actions. Indicators should show trend, target, responsible owner, and escalation status.

Governance fails when reports are technically accurate but omit inconvenient information. It also fails when boards receive excessive data without understanding which risks require action.

10. Worked Application: Designing a Revenue-Cycle Control

Consider a hospital with frequent claim denials caused by missing authorizations and inconsistent patient identifiers.

Risk statement

Claims may be rejected or delayed because registration and authorization information is incomplete or inaccurate.

Control objective

All services requiring authorization should have valid authorization evidence linked to the correct patient and encounter before billing.

Control design

1. Registration staff verify identity using approved identifiers.
2. The system checks payer eligibility and authorization requirements.
3. Exceptions appear on a daily work queue.
4. A billing supervisor reviews unresolved exceptions before claim submission.
5. High-value or high-risk claims receive secondary review.
6. Denials are coded by root cause and reported monthly.
7. Corrective action is assigned to registration, clinical scheduling, coding, or payer liaison teams as appropriate.

Suppose 10,000 claims are submitted in a month and 600 are denied. Using the stated definition:

If 240 of the 600 denials resulted from missing authorization, authorization-related denials represent 40% of all denials:

The second measure is not the overall denial rate. Confusing these denominators could lead management to select the wrong intervention. The hospital should investigate whether the control reduced authorization denials in subsequent months, while also monitoring whether staff improperly delay or exclude difficult claims.

11. Illustrative Case: Riverside Community Hospital

This is a fictional illustrative case.

Background

Riverside Community Hospital experienced declining operating cash despite stable patient volumes. Management initially attributed the problem to payer delays.

Problem

An internal review identified three warning signs: increasing credit balances, frequent manual write-offs, and supplier bank-account changes approved by a single accounts-payable employee. Payroll also contained several inactive temporary workers.

Analysis

The hospital mapped its revenue and expenditure processes. It found that one employee could create a supplier, alter bank details, enter an invoice, and prepare a payment batch. In the revenue cycle, write-offs below a management threshold were not independently reviewed. Payroll termination notices were communicated by email and not reconciled to the payroll master file.

The weaknesses were not simply individual failures. They reflected poor SoD, fragmented systems, inadequate exception reporting, and a culture that valued rapid processing over challenge and documentation.

Approach and solution

The board audit committee required a risk-based remediation plan. Riverside:

• separated supplier maintenance from payment release;
• required independent callback verification for bank changes;
• introduced three-way matching and duplicate-invoice analytics;
• reviewed all unusual write-offs and credit balances;
• reconciled human-resources records to payroll monthly;
• established access recertification and multifactor authentication;
• created a confidential reporting channel;
• trained managers on conflicts of interest and retaliation; and
• assigned internal audit follow-up reviews with deadlines and named owners.

Outcome

After six months, management reported fewer duplicate invoices, faster resolution of credit balances, and improved payroll accuracy. The hospital also discovered that some denials were caused by registration errors rather than payer behavior. Importantly, the board did not treat the improved metrics as proof that risk had disappeared; it required continuing monitoring and independent validation.

Learning points

1. Liquidity problems may originate in weak transaction controls rather than only in external payment delays.
2. Segregation of duties must be examined at the system-permission level.
3. Exception trends are more informative when linked to root causes and accountable owners.
4. Ethical culture and reporting mechanisms are essential complements to technical controls.
5. Remediation is incomplete until effectiveness is tested over time.

12. Limitations and Contemporary Challenges

Controls may become excessive, slow clinical operations, and encourage workarounds. A control that requires numerous approvals for low-value purchases may increase administrative cost without materially reducing risk. Conversely, emergency conditions may justify temporary procedures but require retrospective review.

Other challenges include third-party dependence, ransomware, remote work, cross-border data flows, changing reimbursement rules, workforce shortages, algorithmic bias, and mergers that combine incompatible systems. Organizations should periodically reassess whether controls remain appropriate as processes, technology, and regulation change.

No control framework can substitute for competent leadership. A board may receive excellent reports yet fail if it tolerates unethical behavior by senior executives. Similarly, sophisticated analytics cannot compensate for inaccurate source data or weak investigation procedures.

13. Best-Practice Implementation Roadmap

A practical implementation sequence is:

1. Define governance responsibilities and risk appetite.
2. Map major financial and operational cycles.
3. Identify risks, control objectives, and existing controls.
4. Test design effectiveness and operating effectiveness.
5. Prioritize deficiencies by impact and likelihood.
6. Assign remediation owners and deadlines.
7. Automate high-volume, rule-based controls where appropriate.
8. Train staff and communicate ethical expectations.
9. Monitor indicators and investigate exceptions.
10. Report significant issues to management and the board.
11. Validate remediation independently.
12. Reassess controls after system, process, regulatory, or organizational change.

The most mature organizations integrate financial control with patient-safety governance, enterprise risk management, compliance, information security, and strategic planning.

Chapter Summary

Internal control provides reasonable assurance that healthcare operations, reporting, asset protection, and compliance objectives will be achieved. Its five components are the control environment, risk assessment, control activities, information and communication, and monitoring. Effective design begins with a clear risk statement and control objective and applies proportionality, traceability, least privilege, and segregation of duties.

Cash, procurement, payroll, inventory, billing, claims, and revenue cycles require controls tailored to their distinctive risks. Reconciliations, approvals, access controls, three-way matching, authorization checks, exception reporting, and independent review are central techniques. Internal audit evaluates governance, risk, and control processes; external audit provides reasonable assurance on financial statements; compliance review and investigation serve different purposes.

Fraud risk is shaped by pressure, opportunity, rationalization, and capability. Cybersecurity is integral to financial control because electronic systems process money, claims, and confidential information. Ethical conduct requires integrity, objectivity, confidentiality, competence, fairness, and stewardship. Boards and audit committees must oversee significant risks without replacing management, demand transparent reporting, and monitor remediation.

Key Terms

Internal control: A process providing reasonable assurance over operations, reporting, safeguarding, and compliance.

Reasonable assurance: A high but not absolute level of assurance.

Control environment: The culture, structures, authority, and accountability supporting control.

Risk assessment: Identification and evaluation of events that may affect objectives.

Preventive control: A control intended to prevent an error or irregularity.

Detective control: A control intended to identify an error or irregularity after occurrence.

Corrective control: A control intended to remedy a detected deficiency.

Segregation of duties: Separation of authorization, custody, recording, and review responsibilities.

Three-way match: Comparison of purchase order, receiving report, and supplier invoice.

Revenue cycle: Processes from registration and service delivery through billing, payment, and collection.

Denial: A payer refusal or rejection of a submitted claim.

Internal audit: Independent assurance and consulting activity evaluating governance, risk, and controls.

External audit: Independent examination supporting an opinion on financial statements.

Materiality: The significance of an omission or misstatement to users’ decisions.

Fraud triangle: Pressure, opportunity, and rationalization associated with fraud risk.

Fiduciary responsibility: Duty to act loyally, prudently, and in the organization’s legitimate interests.

Conflict of interest: A situation in which personal interests may influence professional judgment.

Least privilege: Limiting access to what is necessary for a role.

Audit trail: Evidence showing the origin, processing, approval, and modification of a transaction.

Residual risk: Risk remaining after controls operate.

Review Questions

Short Answer Questions

1. What is meant by reasonable assurance in internal control?
2. Identify the four duties commonly separated under segregation of duties.
3. What documents are compared in a three-way match?
4. Distinguish internal audit from external audit.
5. Why is cybersecurity a financial governance issue?

Long Answer Questions

1. Explain the five components of internal control and illustrate each with a healthcare example.
2. Design a control framework for a hospital’s payroll cycle, including risks, control objectives, procedures, evidence, and monitoring.
3. Discuss how ethical culture, fiduciary responsibility, and board oversight interact.
4. Explain the role of internal audit in evaluating revenue-cycle and procurement risks.
5. Evaluate the benefits and limitations of automation and artificial intelligence in financial control.

Analytical / Application Questions

1. A clinic allows one employee to register patients, collect cash, issue refunds, and reconcile the cash drawer. Analyze the risks and propose feasible compensating controls.
2. A hospital’s denial rate falls from 8% to 4%, but patient complaints about billing rise sharply. What additional evidence and metrics should management examine before concluding that revenue-cycle performance improved?
3. An employee reports that a senior manager’s preferred supplier receives unusually high-value contracts without competitive bids. Develop an ethical, investigative, and governance response that protects evidence and avoids retaliation.

Multiple Choice Questions with Answers

Question 1

Which internal-control component includes ethical culture, accountability, and board oversight?

A. Control environment

B. Risk assessment

C. Control activities

D. Monitoring

Correct Answer: A. Control environment

Question 2

Which combination best represents segregation of duties?

A. Authorization, custody, recording, and reconciliation

B. Marketing, recruitment, training, and research

C. Budgeting, forecasting, pricing, and advertising

D. Registration, diagnosis, treatment, and discharge

Correct Answer: A. Authorization, custody, recording, and reconciliation

Question 3

What is the primary purpose of a three-way match?

A. To compare a purchase order, receiving report, and invoice

B. To compare payroll, attendance, and leave records

C. To compare a claim, diagnosis, and patient satisfaction survey

D. To compare a bank statement, budget, and cash forecast

Correct Answer: A. To compare a purchase order, receiving report, and invoice

Question 4

A hospital submits 5,000 claims and 250 are denied. What is the denial rate?

A. 2%

B. 5%

C. 20%

D. 50%

Correct Answer: B. 5%

Question 5

Which activity is most characteristic of internal audit?

A. Issuing a statutory financial-statement opinion

B. Evaluating governance, risk management, and controls

C. Approving every operational transaction

D. Replacing the organization’s finance department

Correct Answer: B. Evaluating governance, risk management, and controls

Question 6

Which is not one of the traditional elements of the fraud triangle?

A. Pressure

B. Opportunity

C. Rationalization

D. Materiality

Correct Answer: D. Materiality

Question 7

Which control most directly addresses unauthorized supplier bank-account changes?

A. Independent callback verification

B. Increasing marketing expenditure

C. Reducing inventory counts

D. Removing purchase orders

Correct Answer: A. Independent callback verification

Question 8

What does least privilege require?

A. All employees receive administrator access

B. Users receive only the access necessary for their roles

C. Access is granted permanently after hiring

D. Managers share credentials with their teams

Correct Answer: B. Users receive only the access necessary for their roles

Question 9

A small clinic cannot fully separate cash collection and recording. Which is an appropriate compensating control?

A. Eliminating bank reconciliations

B. Owner review of bank statements and surprise cash counts

C. Allowing unrestricted petty-cash access

D. Permitting employees to approve their own refunds

Correct Answer: B. Owner review of bank statements and surprise cash counts

Question 10

Which statement about external financial-statement audits is correct?

A. They provide absolute assurance that all fraud has been detected

B. They provide reasonable assurance about material conformity with the reporting framework

C. They replace management’s responsibility for internal control

D. They examine every transaction without sampling

Correct Answer: B. They provide reasonable assurance about material conformity with the reporting framework