Which governance component provides objective assurance on risk management, control effectiveness, and governance processes?

• A. External financial auditing
• B. Internal marketing oversight
• C. Internal audit function
• D. Vendor performance reviews

Answer: (C)

The main idea here is independent assurance about how well an organization manages risk, how effective its controls are, and how governance processes function. The internal audit function is built for this role: it operates independently from management, reports to the board or audit committee, and uses systematic, disciplined methods to evaluate risk management, control activities, and governance processes. By assessing these areas and communicating findings with recommendations, internal audit provides objective assurance that these components are operating as intended and highlights where improvements are needed.

External financial auditing, by contrast, focuses on whether the financial statements are accurate and presented in accordance with accounting standards, not on the broader governance and risk management processes. The other options don’t serve as formal, independent assurance over governance and risk in a comprehensive way: marketing oversight concentrates on marketing activities, and vendor performance reviews assess supplier relations rather than the organization’s governance framework as a whole.