Certified Internal Auditor (CIA) Part 2: Practice of Internal Auditing — Question 188

During an engagement, the chief audit executive (CAE) is notified that the residual risk in several key areas currently exceeds the organization's risk appetite. Upon contacting management, the CAE is advised that no action will be taken, as the existing appetite is unrealistic for current market conditions. According to IIA guidance, which of the following actions would be the most appropriate for the CAE to take?

Answer options

• A. Arrange a meeting with senior management to explain and resolve this issue.
• B. Highlight this issue in the interim audit report and request operational management's response.
• C. Escalate this issue to the board and recommend a more realistic risk appetite.
• D. Hold a meeting with the CEO to obtain further guidance on how to proceed.

Correct answer: A

Explanation

The best action for the CAE is to arrange a meeting with senior management to explain and resolve the issue, as this facilitates direct communication and collaboration to reassess the risk appetite. Highlighting the issue in an interim report or escalating it to the board may not provide immediate resolution, while meeting with the CEO may not involve all necessary stakeholders.