Internal audit organizations do not have a duty to report outside that entity unless required by law, rule, regulation, or policy.
Laws and rules could compel an internal audit organization to report outside that entity.
The boy is shoveling snow.