An organization grants its internal auditors authority to access sensitive confidential information so the auditors...

Providing internal auditors with appropriate access to sensitive and confidential information supports their independence by enabling them to perform engagements without inappropriate restrictions imposed by management or other organizational functions. Internal audit must have sufficient authority and access to relevant records, systems, personnel, and information to fulfill its mandate effectively. Confidentiality governs how auditors protect and use information after obtaining it, but it does not itself provide the authority to obtain the information. Integrity concerns honest and responsible professional conduct, while proficiency and due professional care concern the knowledge, skills, judgment, and diligence applied during audit work. Because unrestricted and appropriate access helps ensure that internal audit can independently determine the evidence necessary for its engagements, independence is the principle most directly supported in this scenario.