B. It is the responsibility of the internal auditor to make a formal report of all deficiencies found in the audit.

C. Since the organization has no specific guidelines, the deficiency is not that some engineers and buyers routinely accept vacation trips paid by certain of the firm's vendors. The deficiency is that the organization has no corporate

code of ethics to provide personnel with guidelines for acceptable conduct.

D. Since the organization has no specific guidelines, the auditor's report should include a recommendation that a code of ethics be adopted in order to provide employees with guidelines for acceptable conduct.