Acceding to IIA guidance, which of the following statements is true regarding the risk assessment process performed by the internal audit activity?

Question

Options

• AThe assessment of high-level risks is typically a linear process.
• BManagement should create the preliminary risk matrix
• CThe analysis should begin with ne identification of objectives
• DLikelihood should receive greater consideration than impact

• A
  3% (1)
• C
  95% (35)
• D
  3% (1)

Explanation

Option C is correct because IIA guidance establishes that identifying the organization's objectives is the foundational first step in risk assessment - you cannot meaningfully identify or evaluate risks without first understanding what outcomes are at stake. Option A is wrong because the IIA describes the risk assessment process as iterative, not linear; it cycles back as new information emerges. Option B is wrong because it is the internal audit activity - not management - that creates the preliminary risk matrix, though management provides input and validation. Option D is wrong because IIA guidance treats likelihood and impact as co-equal factors; neither automatically outweighs the other in determining risk priority.

Memory tip: Use the acronym ORA - Objectives → Risks → Audit plan. You can't know what's at risk until you know what you're trying to achieve, so objectives always come first.

No community discussion yet for this question.