The Chief Audit Executive (CAE) of a Mid-Sized Pharmaceutical Organization

The chief audit executive (CAE) of a mid-sized pharmaceutical organization has operational responsibility for the regulatory compliance function. The audit committee requests an assessment of regulatory compliance. According to IIA guidance, which of the following is the CAE's best course of action?

A) Have a proficient internal audit staff member perform the assessment and disclose the impairment in the audit report and to the board.
B) Have a regulatory compliance staff member perform a self-assessment, to be reviewed by a proficient internal auditor.
C) Have a proficient internal audit staff member perform the audit and report the results of the assessment directly to senior management and the board.
D) Contract with a third-party entity or external auditor to complete the assessment and report the results to senior management and the board.