The chief audit executive (CAE) identified an unacceptable risk and believes that the risk is not being mitigated to an acceptable level. Which of the following is the CAE ' s next step in this situation?
A.
Escalate the concern to senior management
B.
Send a letter to responsible management and provide a deadline to accept the risk
C.
Escalate the concern to the board
D.
Discuss the issue with the members of responsible management
When internal audit identifies a risk that appears unacceptable, the CAE should first discuss the matter with the responsible management. This ensures management has an opportunity to explain their rationale or adjust actions before escalation.
Option A (direct escalation to senior management) or Option C (to the board) are appropriate only if management refuses to act. Option B (sending a letter with a deadline) is not aligned with IIA guidance.
[Reference:, IIA Standards – Standard 2600: Communicating the Acceptance of Risks., , , ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit