Following an IT audit, management has decided to accept the risk highlighted in the audit report. Which of the following would provide the MOST assurance to the IS auditor that management is…

Adequately documenting potential impact and likelihood is a component of risk assessment, but it does not alone assure that the decision to accept the risk was balanced and justified against established organizational criteria.

Established criteria for accepting and approving risk provides the most assurance because it demonstrates that management has a defined framework and consistent methodology for evaluating risks, making deliberate decisions based on predefined thresholds and business objectives. This ensures that risk acceptance is not arbitrary but is a calculated decision aligned with the organization's risk appetite and strategic goals.

A communication plan for informing impacted parties is important for transparency, but it does not provide assurance that the risk acceptance decision itself was appropriate or well-balanced.

Reporting identified risk to the organization's risk committee is a good governance practice, but without established criteria for acceptance, the committee's decision-making process might still lack consistency or a clear rationale for balancing business needs with risk.