Certified Internal Auditor (CIA) Part 1: Business Acumen — Question 230

An internal auditor assessed that the risk of steel theft at a plant is high. In response, the plant’s management introduced a number of controls, including fences around the facility, a metal detector at the entrance, and monthly steel inventory counts. If the controls operate as intended, which of the following outcomes would the internal auditor hope to see?

Answer options

• A. The inherent risk will be mitigated to a level lower than the residual risk.
• B. The inherent risk will be reduced to an acceptable level.
• C. The residual risk will be reduced to an acceptable level.
• D. The residual risk will be eliminated.

Correct answer: B

Explanation

The correct answer is B because the goal of the controls is to reduce the inherent risk of steel theft to a level that is acceptable for the plant's operations. Options A and D are incorrect because inherent risk cannot be lower than residual risk, and residual risk cannot be entirely eliminated. Option C is also incorrect as it addresses residual risk, which is the risk that remains after controls are implemented, but the question focuses on reducing inherent risk.