Which risk management activity would cause the internal auditor to assume a management responsibility?

Question

Options

• AAssessing management's acceptance of risk.
• BReviewing a cybersecurity risk report issued by management.
• CDeveloping a list of emerging risks for management.
• DPrioritizing risks for management.

• A
  5% (1)
• B
  9% (2)
• C
  14% (3)
• D
  73% (16)

Explanation

Prioritizing risks crosses the line from advising to deciding. When an internal auditor prioritizes risks for management, they are making a management decision - determining which risks deserve attention and resources - rather than providing an independent assessment of management's decisions. This violates the independence principle: internal audit should evaluate and advise, not act in a management capacity.

• A is wrong because assessing management's risk acceptance is a classic audit activity - it evaluates whether management's tolerance is appropriate, without making the decision itself.
• B is wrong because reviewing a report management already produced is purely observational and advisory; the auditor isn't creating or owning any output.
• C is wrong because developing a list of emerging risks is informational - it's providing data and perspective to management, who still decide what to do with it. Compiling information ≠ deciding.

Memory tip: Ask yourself, "Is the auditor doing something that management should own?" If the output ends up on a management decision-making document (a ranked risk register, a priority list), the auditor has stepped into management's shoes. The keyword "prioritizing" signals a judgment call that belongs to management, not audit.

No community discussion yet for this question.