CISA · Question #576
Following a discussion on the results of a recent audit engagement, the process owner of the audited area has provided an action plan addressing the gaps and recommendations. The auditor disagrees…
The correct answer is D. Escalate the situation to audit management. When an auditor finds that the process owner is accepting residual risk beyond the organization's defined risk appetite, it is not appropriate to accept the action plan or wait until the next committee Escalating to audit management (D) is the correct step. Audit management can…
Question
Following a discussion on the results of a recent audit engagement, the process owner of the audited area has provided an action plan addressing the gaps and recommendations. The auditor disagrees with some of the responses where the process owner is accepting a level of residual risk that is not within the organization's risk appetite. What is the auditor's BEST course of action?
Options
- AInclude the issue in the next report to the audit committee.
- BInform executive management of the residual risk.
- CAccept the action plan proposed by the process owner.
- DEscalate the situation to audit management.
How the community answered
(43 responses)- A14% (6)
- B9% (4)
- C2% (1)
- D74% (32)
Explanation
When an auditor finds that the process owner is accepting residual risk beyond the organization's defined risk appetite, it is not appropriate to accept the action plan or wait until the next committee Escalating to audit management (D) is the correct step. Audit management can then determine whether to escalate further to executive management or the audit committee. Including in the next report (A) delays timely risk response. Informing executive management directly (B) bypasses the audit reporting hierarchy. Accepting the plan (C) would be inappropriate as it ignores risk governance.
Topics
Community Discussion
No community discussion yet for this question.