Internal audit organizations do not have a duty to report outside that entity unless required by law, rule, regulation, or policy.
Laws and rules could compel an internal audit organization to report outside that entity.
Internal audit organizations cannot be compelled to report outside that entity by any force.