How should auditors document management's acceptance of excessive risk?

author: AcadiFi Team

Answer:

The workpapers should show the risk, affected objective, criteria, evidence, management's explanation, proposed action, residual exposure, and the CAE's basis for concluding that the accepted risk appears above appetite or tolerance. The file should also show the communication path and outcome.

If management agrees to remediate, document the action plan, owner, date, and follow-up method. If management delays, refuses, or accepts exposure beyond tolerance, document that response and the CAE's escalation decision.

The final communication should be accurate, objective, clear, complete, and timely. If management has already taken action, acknowledge it, but do not erase the supported condition or the remaining risk.