The Chief Audit Executive’s most career-limiting error is not failing to find a major risk, but failing to properly escalate it when management accepts it. The new 2024 Global Internal Audit Standards make this escalation path clearer—and wider—than ever before, a nuance that trips up candidates relying on outdated study materials.
When management accepts a level of residual risk that the Chief Audit Executive (CAE) deems unacceptable, the CAE must first discuss the matter with senior management. If unresolved, the CAE must communicate the issue to the board and other appropriate stakeholders, as required by GIAS Standard 5.3.
Key facts
- Governing Standard: IIA Global Internal Audit Standards (GIAS) 2024, specifically Standard 5.3, "Communicating Unresolved Risk Acceptance"
- Exam Section: Part 3: Business Knowledge for Internal Auditing
- Domain: IV. Business Acumen (Governance, Risk Management, and Control)
- Cognitive Level: Proficiency (testing judgment and application)
- Official Body: The Institute of Internal Auditors (IIA)
- Historical Pass Rate: While the IIA no longer publishes official data, historical CIA exam pass rates have typically been in the 40-45% range, underscoring the exam's difficulty.
Why is Communicating Unresolved Risk Acceptance a Critical CIA Exam Topic?
Communicating unresolved risk acceptance is the formal process a CAE must follow when management accepts a risk that could cause significant harm, contrary to the board's strategic direction. This isn't about minor disagreements; it's a high-stakes governance function.
This is one of the most critical judgment areas tested in CIA Part 3 for a simple reason: it separates a technician from a leader.
Studying for CIA CIA3? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
The exam will present you with politically charged scenarios to see if you understand your ultimate responsibility. The most common mistake candidates make is choosing a passive response. They see an answer option like, "The CAE should document management's acceptance in the workpapers and conclude the engagement." It sounds professional and avoids conflict. It is also completely wrong and demonstrates a fundamental misunderstanding of internal audit's role.
Your primary allegiance is to the organization's governance body (the board), not to the operational convenience of senior management. To sharpen your judgment on these nuanced scenarios, you need practice. Try VoraPrep's free CIA practice questions to see how the exam frames these challenges.
What is the Exact Process Under GIAS Standard 5.3?
The entire framework rests on the 2024 Global Internal Audit Standards (GIAS), specifically Standard 5.3. Candidates using older materials that reference the previous IPPF Standard 2600 will get these questions wrong.
Standard 5.3: Communicating Unresolved Risk AcceptanceThis is the current rule. It states: "When the chief audit executive (CAE) concludes that senior management has accepted a level of residual risk that may be unacceptable to the organization, the CAE must discuss the matter with senior management. If the decision regarding residual risk is not resolved, the CAE must communicate the matter to the board and other appropriate stakeholders."
The addition of "and other appropriate stakeholders" is a crucial update. Let’s break this down into a clear decision path.
``mermaid
flowchart TD
A[Audit identifies risk > appetite] --> B{Management accepts the risk};
B --> C[CAE concludes risk is unacceptable];
C --> D{Discuss with Senior Management};
D --> E{Is the issue resolved?};
E -- Yes --> F[Document resolution and close];
E -- No --> G[Communicate to Board AND other appropriate stakeholders];
``
Step 1: Identify the Conflict
The internal audit activity finds that residual risk in a process is higher than the organization’s established risk appetite. A deep understanding of an organization's risk appetite and tolerance is foundational.Step 2: Management Accepts the Risk
For business reasons, like cost or timing, management formally decides to accept this high level of risk.Step 3: CAE Forms a Professional Judgment
The CAE reviews management’s decision and concludes this level of risk is "unacceptable to the organization." This is the CAE's professional opinion, a key step tested on the exam.Step 4: Discuss with Senior Management
The CAE’s first action is to meet with senior management. The goal is to ensure they fully comprehend the potential consequences. This is a final advisory discussion, not a confrontation.Step 5: Escalate to the Board and Stakeholders
If senior management maintains its position, the CAE has a non-negotiable obligation. They must communicate the situation to the board. The 2024 standard adds that they must also communicate to "other appropriate stakeholders," which could include regulators or external auditors, depending on the nature of the risk.The exam will tempt you with answers that skip a step (going straight to the board) or stop too soon (documenting and moving on).
Worked Example: Navigating a Real-World Scenario
Let's walk through a typical exam problem to see how to apply the new standard under pressure.
Test Your CIA Exam Readiness
Evaluate your mastery of the new Global Internal Audit Standards and benchmark your baseline readiness.
> 💡 Worked example: > Maria, the CAE for a retail company, "ShopFast Inc.," has just completed an audit of the company's new e-commerce platform. The audit identified a critical weakness in the customer database encryption. > > - Potential Impact: A breach could result in a $5 million loss from fines and legal fees. > - Risk Appetite: The board has formally documented a risk appetite of no more than $1 million for any single cybersecurity incident. > - Management's Decision: The Chief Technology Officer (CTO) argues that fixing the flaw would delay the holiday season launch, costing an estimated $3 million in sales. The CTO formally accepts the risk for the next quarter, planning to patch the system in January. > > What is Maria's required course of action according to the Global Internal Audit Standards?
This scenario contains a clear risk, a defined appetite, and a business-driven decision by management to exceed it.
Analyze the Situation
The residual risk ($5 million potential loss) is five times the board-approved risk appetite ($1 million). Maria must conclude this is unacceptable.Evaluate the Distractors (The tempting wrong answers)
Here's how an examiner will try to trap you using both old and new rules:- Wrong Answer A: Immediately report the CTO's decision to the board's audit committee.
- Why it's tempting: It seems decisive and shows allegiance to the board.
- Why it's wrong: It skips the mandatory discussion with senior management required by GIAS 5.3. This premature escalation can damage the CAE's working relationship and is a procedural failure.
- Wrong Answer B: Document the CTO's risk acceptance in the final audit report and workpapers, then close the audit.
- Why it's tempting: This is the path of least resistance. It documents the facts without creating conflict.
- Why it's wrong: This is a complete failure of the CAE's responsibility. Simply noting an unacceptable risk without ensuring the board is aware abdicates the core purpose of internal audit.
- Wrong Answer C (The new trap): After discussion with the CTO is unsuccessful, communicate the matter to the board only.
- Why it's tempting: This follows the old IPPF Standard 2600 and seems correct to those with outdated knowledge.
- Why it's wrong: It's incomplete. GIAS 5.3 explicitly adds the requirement to communicate to "other appropriate stakeholders." While the board is the primary recipient, an answer that omits this expanded duty is inferior to one that includes it.
Determine the Correct Path
The correct action follows the GIAS 5.3 sequence precisely.- Correct Action: Maria must first schedule a meeting with the CTO and potentially the CEO to formally discuss her conclusion. She should ensure they understand their decision contradicts the board's stated appetite. If they do not change their position, Maria is then obligated to communicate the matter directly to the board and consider if other stakeholders (e.g., regulators, given the data breach risk) must also be informed.
This approach respects the chain of command while fulfilling the CAE's full responsibility under the current standards, a key part of how to align IA strategy with stakeholder expectations.
Practice Questions: Test Yourself
Theory is one thing; applying it under time pressure is another. Here are a few sample questions. VoraPrep's adaptive engine has thousands of questions to help you build this muscle memory.
Question 1 During an engagement, the internal audit team identified a control weakness that could lead to a $750,000 operational loss. The company's stated risk appetite for operational errors is $250,000. Management accepts the risk, citing the high cost of immediate remediation. What is the CAE's most appropriate next step?---
Question 2 A CAE has concluded that senior management's acceptance of a high-risk deficiency is unacceptable. After an unresolved discussion with the CEO, the CAE prepares to escalate the matter. According to the 2024 Global Internal Audit Standards, which parties must the CAE inform?Study Tips and Exam-Day Strategy
- Beware of Outdated Materials: The single biggest risk on this topic is studying from old textbooks or question banks that reference IPPF Standard 2600. The change to GIAS 5.3 and the addition of "other appropriate stakeholders" is subtle but critical.
- Focus on the "Why": Don't just learn the steps. Understand why the sequence exists: to respect the management structure while ensuring ultimate accountability to the board and other key parties.
- Practice with Scenarios: You cannot memorize your way through this. Use a modern, adaptive question bank like VoraPrep's to work through dozens of scenarios. This builds the judgment you need to pass. Our platform allows you to create custom quizzes focused specifically on governance and risk topics.