IIA-CIA-PART2 · Question #194
An internal auditor at a bank informed the branch manager of a malfunctioning lock on one of the vaults. The risk associated with this issue was deemed significant by the chief audit executive…
The correct answer is B. Discuss the issue with the board which has ultimate responsibility to resolve the risk. If the branch manager decides not to act on a significant risk that was previously acknowledged, the CAE should escalate the issue to the board. The board has ultimate responsibility for risk management and needs to be informed about significant risks and the decisions made by…
Question
An internal auditor at a bank informed the branch manager of a malfunctioning lock on one of the vaults. The risk associated with this issue was deemed significant by the chief audit executive (CAE), and immediate remediation was recommended However during a follow-up engagement the branch manager told the CAE that the risk was actually not significant, hence no action was taken. What is the most appropriate next step for the CAE?
Options
- AInform senior management that the branch manager deeded to cancel the committed action plan
- BDiscuss the issue with the board which has ultimate responsibility to resolve the risk
- CHave another discussion with the branch manager attempt to change his view, and encourage him
- DDocument the branch manager's decision to accept the risk otherwise, no other speak: course of
How the community answered
(18 responses)- A17% (3)
- B67% (12)
- C11% (2)
- D6% (1)
Explanation
If the branch manager decides not to act on a significant risk that was previously acknowledged, the CAE should escalate the issue to the board. The board has ultimate responsibility for risk management and needs to be informed about significant risks and the decisions made by management regarding these risks. This ensures transparency and allows the board to take appropriate action if necessary.
Topics
Community Discussion
No community discussion yet for this question.