Which of the following internal control attributes would an internal auditor test to understand whether...

Internal reporting responsibilities most directly demonstrate whether the organizational structure supports effective internal control. Organizational structure establishes reporting relationships, authority, accountability, responsibility, escalation paths, and segregation of incompatible functions. An internal auditor evaluating this area would therefore examine whether responsibilities and reporting lines are clearly defined and appropriately aligned with organizational objectives and control requirements. Incentives and compensation practices relate primarily to performance management and potential behavioral pressures. Tone at the top concerns management’s ethical values and leadership behavior, while risk management oversight relates to governance responsibilities for identifying and monitoring risk. Although all of these influence the overall control environment, internal reporting responsibilities are the attribute most specifically tied to organizational structure. Consequently, option D is the most appropriate factor to test when determining whether the structure supports effective internal control.