According to HA guidance, which of the following would best support the internal auditor's conclusion that the organization's risk management processes are effective?

Question

Options

• AThe organization has identified all applicable operational and financial risks.
• BThe organization has documented its strategic and business objectives.
• CThe organization has selected risk responses aligned with its risk appetite.
• DThe organization has documented risk information pertinent to its business.

• A
  8% (2)
• B
  73% (19)
• C
  4% (1)
• D
  15% (4)

Explanation

Documented strategic and business objectives are the prerequisite foundation for any risk management process - without knowing what the organization is trying to achieve, an auditor cannot determine whether risks are being identified, assessed, or responded to in a meaningful way. IIA guidance ties risk management effectiveness directly to the support of objective achievement; if objectives aren't established and documented, there is no benchmark against which effectiveness can be measured.

Why the distractors are wrong:

• A is wrong because claiming to have identified all risks is unrealistic and an impossible standard; completeness of identification alone also does not demonstrate effectiveness.
• C is tempting but wrong because selecting aligned risk responses is only one step in the process - it does not by itself establish that the overall risk management process is effective, nor does it provide the context (objectives) needed to evaluate alignment.
• D is wrong because documenting risk information is a hygiene activity, not evidence of effectiveness; you can document risks extensively while still managing them poorly.

Memory tip: Think of objectives as the "target on the wall." Before you can say risk management is hitting the mark, the target must exist and be clearly defined. No documented objectives = no way to measure effectiveness.

No community discussion yet for this question.