Evaluating Management Responses to Key Risks

1. Why This Topic Matters

Identifying and assessing risks is only half of risk management. The real test of an organisation's risk maturity is what management does about the risks it has identified. For the internal auditor providing risk management assurance, evaluating management's responses to key risks is where assurance becomes meaningful: it answers the board's central question, 'Are our most significant risks being handled appropriately, and can we rely on what management is telling us?'

For the CRMA exam, this topic is important for several reasons:

- It sits at the intersection of risk management governance, risk assurance, and communication. Questions can appear under several domains, often disguised as scenario-based items.
- It tests your understanding of core concepts such as inherent risk, residual risk, risk appetite, risk tolerance, risk responses (avoid, accept, reduce, share), and control effectiveness.
- It tests whether you understand internal audit's role: the auditor evaluates and reports on management's responses but does not own the risks or decide how to treat them. Confusing these roles is the most common way candidates lose marks.
- It links directly to the IIA Standards on communicating results, following up on action plans, and escalating accepted risk that may be unacceptable to the organisation (IPPF Standard 2600; Global Internal Audit Standards 2024, Standard 11.5 on Communicating the Acceptance of Risks, and Standard 15.2 on Confirming the Implementation of Recommendations or Action Plans).

2. What It Is: Defining the Concept

A management response to a key risk is the deliberate action (or decision not to act) that management takes to bring a risk within the organisation's risk appetite. In ERM frameworks such as COSO ERM and ISO 31000, these are called risk responses or risk treatments. The four classic categories are:

- Avoid: exit the activity that gives rise to the risk (e.g., discontinue a product line, withdraw from a market).
- Reduce / Mitigate: implement controls or process changes to lower likelihood and/or impact.
- Share / Transfer: pass part of the risk to another party through insurance, outsourcing, hedging, or contractual terms. Note that accountability is never fully transferred.
- Accept / Retain: take no further action because the residual risk is within appetite, or because the cost of treatment outweighs the benefit. Acceptance should be a conscious, documented, and authorised decision, not a default caused by inaction.

In practice there is also a fifth response often referenced: Exploit / Pursue, used when the risk represents an opportunity the organisation wishes to take advantage of.

The term 'management response' also has a second, closely related meaning in the internal audit context: management's formal written reply to an audit observation, stating whether it agrees with the finding, what action it will take, who is responsible, and by when. Internal auditors evaluate these responses to decide whether they adequately address the underlying risk. On the CRMA exam you must be ready for both usages and read the question carefully to determine which one is intended.

Evaluating management responses means the internal auditor forms an independent, evidence-based judgement about whether the response is:

- Appropriate: it matches the nature, cause, and significance of the risk.
- Adequate: if effectively implemented, it would bring residual risk within appetite and tolerance.
- Effective: it is actually operating as intended and producing the expected reduction in risk.
- Timely: it is implemented within a period that is reasonable given the risk's velocity and severity.
- Owned and Accountable: a named individual with sufficient authority is responsible for it.
- Monitored: there are key risk indicators (KRIs), metrics, or reporting that will reveal whether the response continues to work.

3. How It Works: The Evaluation Process

Step 1 - Confirm the key risks and the risk context.
Start from the organisation's risk register, strategic objectives, and the board-approved risk appetite statement. Verify that the risks management is responding to are genuinely the key ones. A perfect response to the wrong risk provides no assurance. Check that the risk is described in terms of cause, event, and consequence so that the response can be matched to the actual driver.

Step 2 - Understand the inherent and residual risk assessments.
Inherent risk is the level before any response; residual risk is the level after the response. Challenge management's assessment: is the claimed reduction realistic? A common weakness is management rating residual risk as low simply because a control exists on paper. The auditor should ask what evidence supports the residual rating.

Step 3 - Assess the design of the response.
Ask: does the response address the root cause or only the symptom? Is the type of response logical (for example, buying insurance does not reduce the likelihood of a data breach; it only shares the financial impact)? Is the response proportionate - neither excessive relative to the risk nor too weak? Does it create new risks (for example, outsourcing introduces third-party risk)? Is it consistent with the organisation's risk appetite and strategic objectives?

Step 4 - Test the operating effectiveness of the response.
Where the response is a control or a set of controls, apply normal audit techniques: inquiry, observation, inspection of documents, re-performance, and data analytics. Where the response is a project or action plan, review progress against milestones, resources assigned, and interim deliverables. Where the response is risk acceptance, confirm that the acceptance was made by someone with the appropriate authority and that it was documented and reported through governance channels.

Step 5 - Evaluate accountability, ownership, and timeliness.
Every key risk response should have a clear owner who has the authority and resources to deliver it. Check target completion dates against the risk's urgency. A response scheduled for completion in eighteen months for a risk that could crystallise next quarter is inadequate regardless of its technical design. Watch for repeated deferrals of due dates, which usually signal either lack of commitment or lack of capability.

Step 6 - Evaluate monitoring and reporting.
Determine whether management has established KRIs, tolerance thresholds, and escalation triggers that would reveal if the response is failing or if the risk is changing. Check that risk reporting to senior management and the board is accurate, complete, and timely, and that it does not understate residual exposure.

Step 7 - Form a conclusion and communicate.
Classify each response. Common classifications include: adequate and effective; adequate in design but not yet implemented or not operating effectively; inadequate (will not bring risk within appetite even if implemented); or no response / unaddressed. Communicate conclusions in the engagement report and, where relevant, in the periodic risk assurance opinion to the audit committee.

Step 8 - Escalate unacceptable risk acceptance.
If the chief audit executive concludes that management has accepted a level of risk that may be unacceptable to the organisation, the CAE must first discuss the matter with senior management. If it is not resolved, the CAE must communicate the matter to the board. This is a mandatory requirement, and it is the auditor's responsibility to communicate, not to resolve the risk or override management's decision.

Step 9 - Follow up.
Establish and maintain a follow-up process to confirm that agreed actions were implemented and that they actually achieved the intended risk reduction. Verifying implementation is not the same as verifying effectiveness; the stronger assurance comes from confirming that residual risk has in fact fallen.

4. Evaluating Management Responses to Audit Observations

When management responds to an audit finding, the internal auditor should evaluate whether the response:

- Acknowledges the root cause rather than disputing facts without evidence.
- Proposes action that would actually resolve the control gap or reduce the risk, rather than a cosmetic fix such as 'we will remind staff of the policy' for a systemic design weakness.
- Assigns a named owner with sufficient seniority.
- Sets a realistic but appropriately urgent completion date.
- Is proportionate to the rating of the finding.

If management disagrees with a finding or declines to take action, the auditor should document management's rationale, assess whether this constitutes acceptance of risk, and determine whether the residual risk may exceed what the organisation would tolerate. If so, the escalation process described above applies. Internal audit should never soften a finding or change a risk rating simply because management disagrees; the report must present the auditor's independent assessment alongside management's response.

5. Red Flags That a Management Response Is Weak

- The response describes activity rather than outcome ('a committee has been formed') with no measurable reduction in risk.
- Residual risk is rated within appetite but no evidence of control testing exists.
- The response is a policy or training with no monitoring of compliance.
- Ownership is assigned to a committee or to 'management' rather than a named individual.
- Due dates have been pushed back more than once.
- The response relies entirely on insurance or contracts for risks that have reputational or regulatory consequences that cannot be transferred.
- The risk register shows the same risk and the same response for several years with no change in rating despite changes in the business environment.
- Risk acceptance has been made at an operational level for a risk that should be decided at executive or board level.
- The response addresses a symptom (correcting individual errors) rather than the root cause (a flawed process or system).

6. Internal Audit's Role and Independence

The IIA's position on internal audit's role in ERM (often illustrated by the 'fan' diagram) is central here. Core assurance roles include evaluating the reporting of key risks and evaluating the management of key risks. Legitimate consulting roles, with safeguards, include coaching management on responding to risks and facilitating workshops. Roles internal audit must not take include setting the risk appetite, deciding on risk responses, implementing risk responses on management's behalf, and taking accountability for risk management. On the exam, any answer choice in which the auditor chooses, designs, owns, or implements the risk response for management is almost always wrong.

7. Exam Tips: Answering Questions on Evaluating Management Responses to Key Risks

Tip 1 - Identify which 'management response' the question means. Read whether the scenario is about a risk treatment in the risk register or about management's reply to an audit finding. The evaluation principles are similar, but the correct answer will be phrased differently.

Tip 2 - Anchor on risk appetite and residual risk. The best answer usually involves comparing residual risk after the response against the board-approved risk appetite and tolerance. If an option mentions inherent risk when the question is about whether the response is sufficient, it is probably a distractor.

Tip 3 - Match the response type to the risk driver. Questions often describe a risk and a proposed response and ask whether it is appropriate. Check whether the response affects likelihood, impact, or neither. Insurance and contracts share impact but do not reduce likelihood; controls and process changes reduce likelihood or impact; exiting the activity avoids the risk entirely.

Tip 4 - Remember that acceptance must be conscious and authorised. If the scenario shows a risk that nobody has acted on, the correct evaluation is 'unaddressed risk' or 'passive acceptance,' not 'risk accepted.' Formal acceptance requires a documented decision by someone with appropriate authority.

Tip 5 - Know the escalation sequence. When the CAE believes management has accepted an unacceptable level of risk: discuss with senior management first; if unresolved, communicate to the board. The auditor does not override management, does not implement the control, and does not withhold the report. Look for the option that follows this exact sequence.

Tip 6 - Distinguish design, implementation, and effectiveness. A response can be well designed but not implemented, or implemented but not operating effectively. The exam rewards candidates who recognise that confirming implementation is weaker assurance than confirming the risk has actually been reduced.

Tip 7 - Root cause beats symptom. When asked which management response is most appropriate, prefer the option addressing the underlying cause over one that corrects individual instances or merely reminds staff of policy.

Tip 8 - Ownership, timeliness, and monitoring are evaluation criteria too. If several answer options describe technically sound responses, the best one will include a named owner, a realistic deadline, and a means of monitoring (KRIs or reporting). An otherwise good plan with no owner or no date is incomplete.

Tip 9 - Protect auditor independence. Eliminate any option in which internal audit decides the response, owns the risk, or implements the fix. The auditor evaluates, recommends, communicates, and follows up.

Tip 10 - Watch for 'most' and 'best' wording. CRMA questions frequently ask for the most appropriate action or the best indicator. Several options may be partially correct. Choose the one that is most complete, most consistent with the Standards, and most closely tied to the organisation's objectives and risk appetite.

Tip 11 - Do not soften findings for management agreement. If a question describes management disputing a finding without evidence, the correct answer involves presenting the auditor's independent conclusion alongside management's response, not revising the rating to achieve consensus.

Tip 12 - Think like the audit committee. Ask yourself what the board would need to know: Are the key risks being managed within appetite? Where are they not? Who is accountable? What is being done and by when? Answer options that help the board answer those questions are usually the ones the examiners are looking for.

8. Quick Revision Summary

- Risk responses: avoid, reduce, share, accept (and exploit for opportunities).
- Evaluate responses for appropriateness, adequacy, effectiveness, timeliness, ownership, and monitoring.
- Compare residual risk to risk appetite and tolerance; challenge residual ratings with evidence.
- Acceptance must be deliberate, documented, and authorised at the right level.
- Internal audit evaluates and communicates; management owns and decides.
- Unacceptable risk acceptance: discuss with senior management, then escalate to the board.
- Follow up to confirm not only implementation but actual reduction in risk.

Master these principles and practise applying them to short scenarios, and you will be well prepared for any CRMA question on evaluating management responses to key risks.