An internal auditor is assigned to perform an engagement to evaluate the organization’s insurance program, including the appropriateness of the approach to minimizing risks. The organization self-insures against large casualty losses and health benefits provided for all its employees. It is a large national entity with over 15,000 employees located in various parts of the country. It uses an outside claims processor to administer its health care program. The organization’s medical costs have been rising by approximately 8% per year for the past five years, and management is concerned with controlling these costs. The internal auditor needs to determine the scope of the proposed evaluation of insurance coverage. Which of the following statements are true regarding the potential scope of the engagement?
1. The internal audit activity should concentrate on processing that occurs within the organization and not on evaluating the correctness of transactions processing by the health care processor.
2. The internal auditor should interview management prior to beginning the engagement to understand (1) its concerns and (2) the underlying assumptions made and rationale used when making the self-insurance decision.
3. The internal auditor should consider engaging an actuarial consultant to better understand the risks involved in order to help determine the scope of the engagement.