The chief audit executive (CAF) determined that the residual risk identified in an assurance engagement is acceptable. When should this be communicated to senior management?

Question

Options

• AWhen the CAE reports the audit outcome to senior management.
• BWhen the residual risk is identified before the engagement is complete.
• CImmediately, as residual risk should be communicated as soon as possible
• DWhen management of the area under review has resolved and mitigated the residual risk

• A
  90% (19)
• B
  5% (1)
• C
  5% (1)

Explanation

The chief audit executive (CAE) has the responsibility to communicate audit results, including residual risks, to senior management. According to IIA Standard 2410 - Criteria for Communicating, the CAE should communicate the engagement's objectives, scope, conclusions, recommendations, and action plans. Residual risk, being a part of the audit outcome, should be reported at the same time as the audit results to ensure that senior management is fully informed of all aspects of the engagement. This allows senior management to understand the remaining risks after control measures have been applied.

No community discussion yet for this question.