An internal auditor conducts an assessment of a two-year-old IT risk management program. Which of the following findings should be of MOST concern to the CIO?

If organizational responsibility for IT risk management is not clearly defined, it indicates a fundamental flaw in the program's structure, leading to potential gaps in accountability, inconsistent application of controls, and an overall ineffective risk posture. This lack of ownership prevents effective decision-making and execution of risk mitigation strategies.

While desirable, a lack of specific risk management certifications among team members is a training gap, not a foundational structural issue with the program's governance.

Few key risk indicators (KRIs) being used indicates an issue with monitoring and measurement, which is less critical than the fundamental lack of responsibility for the entire program.

Improper retention of IT risk training records is a compliance and documentation issue, which is less impactful than a lack of clear responsibility for the risk management program itself.