An internal auditor assessed that the risk of steel theft at a plant is high. In response, the plant's management introduced a number of controls, including fences around the facility, a metal…

Question

Options

• AThe inherent risk will be mitigated to a level lower than the residual risk.
• BThe inherent risk will be reduced to an acceptable level.
• CThe residual risk will be reduced to an acceptable level.
• DThe residual risk will be eliminated

• A
  10% (2)
• B
  5% (1)
• C
  80% (16)
• D
  5% (1)

Explanation

C is correct because controls do not change inherent risk - they produce a residual risk (what remains after controls are applied). The auditor's goal is for those controls (fences, metal detector, inventory counts) to reduce the residual risk to an acceptable level, not necessarily zero.

Why the distractors fail:

• A is backwards: inherent risk is always higher than residual risk by definition, so it can never be "mitigated to a level lower than* residual risk."
• B is wrong because inherent risk is fixed - it reflects risk before any controls exist and does not change when controls are introduced; only residual risk changes.
• D is wrong because eliminating risk entirely is almost never achievable or the stated goal; management aims to reduce risk to an acceptable level, not zero.

Memory tip: Use the word order as a clue - Inherent comes before controls (it's the "inherited" starting point), and Residual is what Remains after controls do their job. Auditors evaluate whether that remainder is acceptable.

No community discussion yet for this question.