To whom should deficiencies disclosed by an internal control evaluation be reported?

The correct answer indicates that deficiencies disclosed by an internal control evaluation should be reported both to the person responsible for the control and to an appropriate person at least one level higher. This dual reporting structure is important because it ensures that the individual directly overseeing the control is made aware of its deficiencies, which allows for immediate attention and potential corrective actions.

Simultaneously, notifying a higher authority is critical for maintaining an effective control environment. This person typically has the broader organizational perspective and the responsibility to allocate resources or initiate policies that can address systemic issues linked to the deficiencies. Moreover, reporting to higher management enhances accountability, encourages a culture of transparency, and ensures that deficiencies are taken seriously within the organization.

In focusing solely on one of the reporting options, whether just to the individual responsible or just to the higher authority, would potentially limit the effectiveness of the internal control system and could lead to unresolved issues if the corrective actions are not prioritized appropriately. Therefore, combining both reporting paths is essential for robust risk management and internal control compliance.