7Internal audit organizations do not have a duty to report outside that entity unless required by law, rule, regulation, or policy.
Internal audit organizations only have to report outside entities if it is required by law.
Internal audit organizations must report to outside entities at all times.