Certified Internal Auditor (CIA) Part 2: Practice of Internal Auditing — Question 273

Upon completing a follow-up audit engagement, the chief audit executive (CAE) noted that management has not implemented any mitigation measures to address the high risks that were reported in the initial audit report. What initial step must the CAE take to address this situation?

Answer options

• A. Communicate the issue to senior management.
• B. Discuss the issue with members of management responsible for the risk area.
• C. Report the situation to the external auditors.
• D. Escalate the issue to the board.

Correct answer: B

Explanation

The correct answer is B because discussing the issue with the members of management responsible for the risk area allows for direct communication and understanding of the reasons behind the lack of action. Options A, C, and D are less effective initial steps, as they involve higher levels of escalation without first addressing the issue directly with those who can take immediate action.