Which statement best describes internal audit's role?

• A. Internal audit is NOT a guarantee of pen testing, SOC, or breach prevention.
• B. Internal audit guarantees breach prevention.
• C. Internal audit conducts malware removal.
• D. Internal audit deploys security controls.

Answer: (A)

Internal audit provides independent assurance on governance, risk management, and control processes, evaluating whether security controls are properly designed and operating effectively to mitigate risk. It does not guarantee security outcomes nor perform operational security tasks. Penetration testing, Security Operations Center functions, and breach prevention are responsibilities of management and IT security teams; internal audit may review these activities and their results and recommend improvements, but it cannot certify that a breach won’t happen or that a test will succeed. The value of internal audit lies in assessing evidence of control effectiveness and advising on improvements, not in guaranteeing preventive outcomes.