As a result of server managements assumption of risk there is residual risk that exceeds me organisation ' s risk appetite. Which of the following actions would be most appropriate for the chief audit executive to take?
A.
ignore the responsibility of addressing the residual risk
B.
Assume the responsibility of addressing the residual risk
The CAE has a responsibility to communicate significant risks to the board, particularly when the residual risk exceeds the organization ' s risk appetite. By communicating with the board, the CAE ensures that the highest level of governance is aware of the risk and can make informed decisions about how to address it. Ignoring the risk, assuming responsibility without authority, or only ensuring senior management ' s acknowledgment without further action would be insufficient and not in line with the CAE’s duties.
[References:, The Institute of Internal Auditors (IIA) Standards, Internal Audit’s Role in Risk Management, , , ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit