What does the escalation path look like if a risk remains unacceptable after management response?

Question

AcadiFi · Accepted Answer

Start by distinguishing ordinary remediation from unacceptable residual risk. If the issue is minor and management has a credible action plan, communication may stay at the local level. If management's response leaves risk above appetite, internal audit usually escalates through the CAE to the level of governance with authority to evaluate that risk acceptance, often senior management or the board.

Imagine Blue Harbor Data hosts client records worth $11 million of annual revenue. An audit finds terminated employees retaining privileged access for 17 days on average, far beyond the 24-hour removal policy. Operations management says the issue is tolerable because no incident has been reported. Internal audit should document the exposure, evaluate whether the residual risk exceeds appetite, and communicate accordingly. If the response is inadequate, the CAE would typically elevate the matter beyond process management so oversight bodies can decide whether that risk acceptance is appropriate.

```mermaid
flowchart LR
  A[Issue identified] --> B[Management response]
  B -->|Adequate| C[Track remediation]
  B -->|Unacceptable residual risk| D[Escalate through CAE]
  D --> E[Senior management or board]
```

CIA questions usually favor structured escalation, not emotional escalation. The point is to get unresolved risk in front of the right decision-maker with evidence, context, and impact clearly stated. Practice more in our CIA question bank.

What does the escalation path look like if a risk remains unacceptable after management response?

Master Part 3 with our CIA Course

Related Questions

Practice Questions