Senior management is eager to assess the organization's risks with regard to electricity sales processes, but the senior management team does not know where to start. Mow can the internal audit…

Question

Options

• AOutsource the identification of best practices for risk management to an external third party.
• BPerform an audit engagement to identify risk management practices deployed in electricity sales
• CRecommend reporting the lack of risk management to government authorities and request
• DFacilitate a self-assessment workshop with the employees responsible for process execution.

• A
  4% (1)
• B
  7% (2)
• C
  85% (23)
• D
  4% (1)

Explanation

There appears to be an error in the marked correct answer. Based on IIA standards and internal audit best practices, option D is the correct answer, not C.

Why D is correct: Facilitating a Control Self-Assessment (CSA) workshop is a recognized internal audit technique for helping management "get started" with risk identification. When senior management lacks direction, internal audit can convene the employees closest to the process to identify, assess, and prioritize risks collaboratively - fulfilling the advisory role without overstepping audit independence.

Why the other options are wrong:

• A is wrong because outsourcing risk identification to a third party abdicates internal audit's responsibility and adds unnecessary cost when the expertise already exists internally.
• B is plausible but premature - performing a full audit engagement before management has even begun to understand their risks puts the cart before the horse. A workshop helps first.
• C is wrong because escalating to government authorities is an extreme, disproportionate step. There is no evidence of a reportable violation - only a gap in maturity.

Memory tip: Think of the acronym FACILITATE first - when management is lost on risk, internal audit's advisory role is to guide, not audit or escalate. CSA workshops are the IIA-endorsed starting point when organizations are building risk awareness from scratch.

Note: If this question came from a specific exam bank, double-check the answer key - "C" as written is also incomplete (the sentence cuts off), suggesting a formatting error in the source material.

No community discussion yet for this question.