Which of the following is NOT one of the five GAO internal control standards?

• A. Control Environment
• B. Risk Assessment
• C. Control Activities
• D. Auditing

Answer: (D)

GAO’s internal control framework centers on five components: the control environment, risk assessment, control activities, information and communication, and monitoring. Auditing isn’t one of these components; it’s an evaluative activity that may be performed to test whether the controls are working, but it sits outside the five standard elements.