Which of the following would best assist the internal audit activity in assessing whether an organization's responses to risk are aligned with its risk appetite?

Question

Options

• AAnalyzing the results of successful testing of controls and monitoring procedures implemented by
• BDetermining that there are no gaps between the internal auditors' risk assessment and the risk
• CObtaining evidence that employees throughout the organization are aware of the organization s
• DVerifying that previously identified organizational risks were documented in board meeting

• A
  78% (36)
• B
  4% (2)
• C
  7% (3)
• D
  11% (5)

Explanation

Option A is correct because testing controls and monitoring procedures directly verifies whether the risk responses management put in place are actually functioning to keep risks within the organization's defined risk appetite - if controls are working as designed, risks are being managed to acceptable levels.

Why the distractors fall short:

• B compares the auditors' own risk assessment to another risk assessment - this reveals alignment between assessments, not between responses and risk appetite. Assessments agreeing doesn't confirm risks are being managed appropriately.
• C checks employee awareness of policies, but awareness alone doesn't confirm that actual risk responses are calibrated to appetite. You can know the speed limit and still drive too fast.
• D verifying board documentation of past risks shows record-keeping, not whether management's responses are keeping risks within acceptable bounds going forward.

Memory tip: Think of it as "evidence of effect, not intent." Options B, C, and D all deal with documentation, awareness, or assessments - they show that people know about risks. Option A is the only one that tests whether risk responses are actually doing their job, which is what "aligned with risk appetite" means in practice.

No community discussion yet for this question.