Sooner or later management decides not to fix something internal audit reported. That is a legitimate management choice when the risk is within appetite. Standard 11.5 of the IIA Global Internal Audit Standards covers the other case, where the accepted level of risk exceeds what the organization has said it will tolerate. The requirements are short, and each sentence changes what the chief audit executive does.
What the standard says
The chief audit executive must communicate unacceptable levels of risk. When the chief audit executive concludes that management has accepted a level of risk that exceeds the organization's risk appetite or risk tolerance, the matter must be discussed with senior management. If the chief audit executive determines the matter has not been resolved by senior management, it must be escalated to the board. The standard closes with a limit: it is not the responsibility of the chief audit executive to resolve the risk.
Three things follow.
- The trigger is a comparison to appetite or tolerance, not to internal audit's preference. If the organization has no documented tolerance, the chief audit executive has nothing objective to compare to, and the first recommendation is to establish one. Standard 13.2 requires auditors to gather information about the organization's risk tolerance, if established, when assessing risks for an engagement.
- The path is sequential: the implementation text has the chief audit executive first address the issue with the management responsible for the risk area, then discuss it with senior management, and escalate to the board only if it stays unresolved.
- Internal audit reports and does not decide. Management and the board own the risk decision.
How the issue arises
Standard 15.2 makes the chief audit executive responsible for determining whether senior management, by delay or inaction, has accepted a risk that exceeds the risk tolerance when action plans miss their completion dates. See /us/blog/internal-audit-follow-up-and-action-plan-tracking-standard-15-2. Acceptance can also be explicit: a business owner signs a risk acceptance form, or an executive declines a recommendation in the management response.
Worked example
In this hypothetical, during a review of IT general controls at a $220 million distributor, internal audit found that 14 terminated employees retained active ERP accounts for more than 30 days, including 3 with approval authority over payments. Management agreed in the report to deprovision on termination within 24 hours and to build an automated feed from the human resources system. The due date passed. The feed was deferred for two quarters because of a budget freeze. The company's risk appetite statement, approved by the board, says there is no tolerance for unauthorized access to systems that initiate or approve financial transactions.
The chief audit executive's sequence:
- Discuss with senior management. Meeting with the chief financial officer and the chief information officer, recorded in a memo. The CFO offers an interim measure: a weekly manual review of terminations against active accounts. Internal audit evaluates it. A weekly manual review reduces the exposure window from months to days, but three approvers could still act within that window.
- Assess whether the matter is resolved. The CAE concludes the interim step reduces the risk but leaves it above the stated tolerance for approval-level accounts. Management says it accepts that residual position until the feed is built.
- Escalate. The CAE brings the item to the audit committee as an accepted risk, with the finding, the exposure (three approvers, payment authority limits), the interim control, management's rationale, the time to full remediation, and what internal audit will test and when.
The committee can agree with management, ask for a faster fix, or direct a compensating control such as an immediate disabling of approval rights for any employee flagged in the manual review. Whatever it decides, the minutes record it. Internal audit then follows up on whatever the committee asked for. Resolution belongs to management and the board.
Documenting acceptance
Keep a log of accepted risks outside the finding tracker, with these fields: finding reference, risk description, tolerance statement it exceeds, who accepted, date, rationale, compensating measures, expiry or review date, and the board or committee minute reference. An acceptance with no expiry date outlives the circumstances that justified it.
Connecting to reporting
Standard 8.1 requires the chief audit executive to report to the board and senior management the results of internal audit services, including conclusions, themes, assurance, advice, insights and monitoring results. It also requires the CAE to give the board the facts when the CAE disagrees with senior management on the scope, findings or other aspects of an engagement that could affect internal audit's ability to execute its responsibilities, so the board can decide whether to intervene. Standard 11.3 adds that themes, such as recurring root causes, must be communicated timely. An accepted risk that recurs across engagements is a theme worth reporting.
What a CPA firm advising on this should watch for
- A management response that says "risk accepted" without citing who has authority to accept it. Authority limits should be in the risk governance documents.
- Acceptances by a business unit head of risks that affect other units. Enterprise risks need enterprise-level acceptance.
- A chief audit executive who stays silent because the board meets in two months. The standard says unresolved matters must be escalated. Standard 8.1 notes that the chief audit executive and board members often communicate between meetings as needed, so a meeting date is not a reason to wait.
For the reporting list in full, see /us/blog/what-the-chief-audit-executive-must-report-to-the-board-standard-8-1.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- The IIA, Global Internal Audit Standards (2024), Standards 8.1, 11.3, 11.5, 13.2, 15.2: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error