An organization's internal compliance audit program is restricted solely to reviewing general ledger entries and financial accounting controls, completely omitting reviews of anti-bribery protocols, export controls, and data privacy safeguards. This restriction represents a critical deficiency in which of the following areas?

The correct answer is B, "The scope of the audit program." The scope of an audit program defines the boundaries, subject matter, and risk areas that the audits will cover. To be effective, a compliance audit program must be risk-based and comprehensive, addressing all significant compliance risks faced by the organization—including anti-corruption, data privacy, environmental regulations, and trade compliance—not just financial controls. Restricting the audit scope to financial matters leaves major compliance risks unmonitored, which can lead to undetected systemic violations and severe regulatory penalties. A well-designed audit scope ensures that the organization proactively identifies vulnerabilities across all regulatory domains.

Let's look at the distractors to see why they are incorrect: - A (The selection of corrective actions) is incorrect because corrective actions are the remediation steps taken after a deficiency is found. The failure to look at non-financial areas in the first place is a scoping failure, not a remediation design issue. - C (The design of preventive controls) is incorrect because auditing is a detective/monitoring control. While auditing evaluates the effectiveness of preventive controls, a gap in what the audit covers is a scoping deficiency of the audit program itself. - D (The company's marketing strategy) is incorrect because marketing strategies are business-oriented plans to promote products or services and have no direct relationship to the operational scope of internal compliance audits.