Exam IIA-CIA-Part2 topic 5 question 460 discussion

Actual exam question from IIA's IIA-CIA-Part2

Question #: 460
Topic #: 5

During an engagement, the chief audit executive (CAE) is notified that the residual risk in several key areas currently exceeds the organization's risk appetite. Upon contacting management, the CAE is advised that no action will be taken, as the existing appetite is unrealistic for current market conditions. According to IIA guidance, which of the following actions would be the most appropriate for the CAE to take?

A. Arrange a meeting with senior management to explain and resolve this issue.
B. Highlight this issue in the interim audit report and request operational management's response.
C. Escalate this issue to the board and recommend a more realistic risk appetite.
D. Hold a meeting with the CEO to obtain further guidance on how to proceed.

Show Suggested Answer

Suggested Answer: C 🗳️

by Kozy at July 25, 2025, 5:12 p.m.

Comments

Submit Cancel

Kozy

1 week ago

Selected Answer: A

The phrase "upon contacting management" indicates the CAE already spoke to management. In IIA terminology: “Management” typically refers to operational or functional management. “Senior management” refers to executives (e.g., CFO, COO, CEO). “The board” means the audit committee or full board. Since the CAE contacted “management” but not explicitly senior management, the next step — according to IIA Standard 2600 — would logically be: Discuss the issue with senior management. Therefore, the correct answer is: A. Arrange a meeting with senior management to explain and resolve this issue.

upvoted 1 times

...