anchor: Internal audit organizations do not have a duty to report outside that entity unless required by law, rule, regulation, or policy.
positive: Laws and rules could compel an internal audit organization to report outside that entity.
negative: Internal audit organizations cannot be compelled to report outside that entity by any force.