Both hierarchical and open organizational structures require responsibility to be supported by adequate authority. Assigning responsibility without authority creates accountability failure and control weakness. Both structures also recognize that a superior may delegate tasks or authority but cannot delegate ultimate responsibility for results. Statement 1 is more characteristic of open or decentralized structures, not all hierarchical structures. Statement 2 is an outdated and rigid span-of-control rule; appropriate span depends on complexity, employee competence, technology, geography, and control needs. Internal audit should evaluate whether organizational design supports clear accountability, authority, escalation, segregation of duties, and effective oversight. The principles common to both structures are statements 3 and 4. Therefore, Option D is correct.