text: Internal audit organizations do not have a duty to report outside that entity unless required by law , rule , regulation , or policy .
  
  ###
  
  Laws and rules could compel an internal audit organization to report outside that entity .