A multinational organization has asked the internal audit activity to assist in setting up the organization's risk management system. The chief audit executive (CAE) agrees to take on the engagement…

Question

Options

• ACoordinate and facilitate risk workshops for management to attend.
• BEstablish the degree of risk appetite for management to accept.
• CSet risk indicators and mitigation plans for management to implement
• DDetermine the number of significant risks for management to report to the board.

• A
  72% (18)
• B
  4% (1)
• C
  8% (2)
• D
  16% (4)

Explanation

When the CAE acts as a consultant to management on risk management, the key boundary is that management must retain ownership of all decisions - the CAE can facilitate and advise, but cannot make decisions on management's behalf. Coordinating and facilitating risk workshops (A) is appropriate because it supports management in doing their own work without the CAE usurping their decision-making authority.

Why the distractors are wrong:

• B is wrong because setting the degree of risk appetite is a management and board decision - the CAE cannot determine what level of risk the organization should accept.
• C is wrong because setting risk indicators and mitigation plans means making risk management decisions, which belongs to management, not the internal audit activity.
• D is wrong because determining which risks are "significant" to report to the board is a judgment call that belongs to management, not the auditor.

Memory tip: Think of the CAE-as-consultant rule as "facilitate, never decide" - any choice where the CAE is setting, establishing, or determining something that management or the board should own is automatically wrong; the CAE can only support those conversations (e.g., running workshops, providing frameworks), never drive the outcome.

No community discussion yet for this question.