Management Acceptance of Unacceptable Risk
5 minutes
5 Questions
Management Acceptance of Unacceptable Risk is a critical concept within the Certification in Risk Management Assurance (CRMA) framework, specifically under the domain of communicating risk management assurance. It addresses situations where internal audit or risk assurance professionals identify a risk that, in their professional judgment, exceeds the organization's risk appetite or tolerance, yet management decides to accept that risk rather than mitigate, transfer, or avoid it. According to IIA Standard 2600 (Communicating the Acceptance of Risks), when the Chief Audit Executive (CAE) concludes that management has accepted a level of risk that may be unacceptable to the organization, the CAE must discuss the matter with senior management. If the CAE determines that the matter has not been resolved after this discussion, the CAE must escalate and communicate the issue to the board. This creates a formal governance safeguard ensuring that significant risk decisions receive appropriate oversight. Key elements of this process include: first, identifying the residual risk level after existing controls and comparing it against established risk appetite; second, documenting management's rationale for accepting the risk, including any cost-benefit considerations; third, holding constructive dialogue with senior management to clarify understanding and potential consequences; and fourth, escalating unresolved disagreements to the board or audit committee. Importantly, the CAE's role is not to make the risk decision or override management, since risk ownership rests with management. Rather, the CAE ensures transparency, so that those charged with governance are fully informed. Effective communication should be objective, factual, balanced, and timely, presenting the risk's potential impact, likelihood, and alignment with strategic objectives. For CRMA candidates, mastering this concept demonstrates understanding of independence, professional courage, and the escalation protocols that protect organizational value. It reinforces that risk assurance involves not only evaluating controls but also ensuring that accepted risks are consciously and appropriately approved at the right governance level.
Management Acceptance of Unacceptable Risk: A Complete CRMA Guide (Communicating Risk Management Assurance)
1. Why This Topic Matters
Management acceptance of unacceptable risk sits at the intersection of two of the most sensitive relationships in governance: the relationship between internal audit and senior management, and the relationship between internal audit and the board. It is one of the few places in the IIA's standards where the Chief Audit Executive (CAE) is given a mandatory escalation duty that can bypass management and go straight to the board. For that reason it is heavily tested in the CRMA exam, particularly within the Communicating Risk Management Assurance domain.
In practice, the topic matters because:
- Management owns risk and is entitled to accept risk, but the board sets risk appetite and ultimately holds management accountable.
- The board cannot discharge its oversight duty if it is unaware that management is running the organization outside the agreed risk appetite.
- Internal audit is the independent function best positioned to observe the gap between accepted risk and tolerable risk and to make sure it is visible at the right level.
- Failure to escalate exposes the organization, the board and the CAE personally to reputational and professional consequences.
If you understand this topic well, you will also understand how risk appetite, residual risk, follow-up, reporting lines and CAE independence fit together, so it is a high-leverage area to master.
2. What It Is: The Standard in Plain Language
Under the 2017 International Standards (Standard 2600 – Communicating the Acceptance of Risks):
"When the chief audit executive concludes that management has accepted a level of risk that may be unacceptable to the organization, the chief audit executive must discuss the matter with senior management. If the chief audit executive determines that the matter has not been resolved, the chief audit executive must communicate the matter to the board."
The Interpretation adds three crucial points:
- The identification of risk accepted by management may be observed through an assurance or consulting engagement, through monitoring progress on actions taken by management as a result of prior engagements (follow-up), or through other means.
- It is not the responsibility of the CAE to resolve the risk.
- The standard applies to risk that may be unacceptable to the organization, not merely risk the auditor personally dislikes.
Under the 2024 Global Internal Audit Standards (Standard 11.5 – Communicating the Acceptance of Risks):
The requirement is essentially unchanged but is expressed more explicitly in terms of risk appetite: if the CAE concludes that management has accepted a level of risk that exceeds the organization's risk appetite or may be unacceptable to the organization, the CAE must discuss the matter with senior management, and if it is not resolved, must escalate it to the board. The 2024 Standards also make clear that the identification can come from any source, including engagements, follow-up, or other information, and that the CAE must consider whether the matter has been resolved before deciding whether escalation is needed.
Whichever version your exam references, the logic is identical. Learn the sequence and the roles, and you will be able to answer either.
3. Key Definitions You Must Hold in Your Head
- Risk appetite: the level of risk the organization is willing to accept in pursuit of its objectives; set by the board/senior management.
- Risk tolerance: the acceptable variation around objectives; the operational expression of appetite.
- Residual risk: the risk remaining after management has taken action to reduce impact or likelihood. This is the risk that management actually "accepts."
- Risk acceptance: a legitimate risk response in which management consciously decides to retain a risk rather than avoid, reduce, or share it.
- Unacceptable risk: risk that exceeds the organization's appetite or that could threaten the achievement of objectives, compliance, reputation or viability in a way the board would not knowingly tolerate.
- Senior management: the executive level with authority to take corrective action; the first stop in the escalation path.
- The board: the highest governing body (or its designated committee, typically the audit committee); the final stop in the escalation path.
4. How It Works: The Escalation Process Step by Step
Step 1 – Identification. The CAE becomes aware that management has accepted a risk. Sources include: findings in an assurance engagement where management declines to take corrective action; consulting engagement observations; follow-up procedures (Standard 2500 / Standard 15.2) revealing that agreed actions were never implemented; risk register reviews; whistleblower information; or discussions in management committees.
Step 2 – CAE judgment. The CAE, not the engagement auditor, must conclude that the accepted level of risk may be unacceptable to the organization. The test is objective and organizational: is this beyond what the board would knowingly tolerate given stated appetite, strategy, legal obligations and stakeholder expectations? The CAE should consider the risk appetite framework, severity, likelihood, velocity, aggregation with other accepted risks, and whether the acceptance was made by someone with authority to accept it.
Step 3 – Discuss with senior management. This is mandatory and comes first. The purpose is to ensure management fully understands the risk, to confirm whether the acceptance was informed and authorized, to give management the opportunity to reconsider or to provide information that changes the CAE's assessment, and to explore remediation. Many matters are resolved here, either because management acts or because the CAE learns the risk is actually within appetite.
Step 4 – Determine whether the matter is resolved. Resolution means that either the risk has been brought within acceptable levels (management has acted or committed to act credibly), or the CAE is satisfied the risk was never actually unacceptable, or the risk has already been knowingly accepted at an appropriate level of governance (e.g., the board itself approved it). "Resolved" does not mean management simply reaffirmed its decision.
Step 5 – Communicate to the board. If the matter remains unresolved, the CAE must communicate it to the board. This is not optional and does not require management's permission. The communication should be factual, balanced, and should include the nature of the risk, why the CAE considers it potentially unacceptable, management's position and rationale, and the discussions held. The board then decides. The board may agree with management (in which case the risk has been accepted at the correct level of governance and the matter is closed), or may direct action.
Step 6 – Document and move on. The CAE documents the chain of judgment and communications. Internal audit does not implement the fix and does not take ownership of the risk. Internal audit may schedule future follow-up.
5. What the Standard Does NOT Require or Permit
Exam distractors often rely on misunderstanding the boundaries of this standard. Note the following:
- The CAE is not required or permitted to resolve, remediate or own the risk. Doing so would impair independence and objectivity.
- The CAE should not go straight to the board without first discussing the matter with senior management (unless senior management is itself the source of the problem in a way that makes discussion futile or inappropriate, for example suspected executive fraud, which is handled under different considerations).
- The CAE should not report the matter externally to regulators, external auditors, or the press as a first response. External reporting is governed by law, the charter, and board direction, not by Standard 2600 / 11.5.
- The CAE should not refuse to issue the engagement report, withdraw from the engagement, or change the rating to force management's hand.
- The CAE should not accept management's assurance at face value if the facts indicate the risk remains outside appetite.
- The CAE does not need board approval to discuss the matter with senior management, and does not need management approval to escalate to the board.
- Management's acceptance of risk within appetite, after an informed decision by a person with appropriate authority, is a legitimate risk response and does not trigger escalation.
6. Linkages to Other CRMA Concepts
- Risk management assurance: when providing assurance on the effectiveness of the risk management process, the CAE evaluates whether risk acceptance decisions are made at the appropriate level and within appetite. A pattern of unauthorized acceptance is itself a control deficiency in the risk management framework.
- Follow-up (Standard 2500 / 15.2): the CAE must establish a follow-up process and must ascertain that actions have been implemented or that senior management has accepted the risk of not taking action. This is the most common route into Standard 2600 / 11.5.
- Reporting to the board (Standard 2060 / 8.1 and 11.3): the CAE's periodic reporting to the board must include significant risk and control issues, including unacceptable risks accepted by management.
- Independence and organizational positioning (1110 / 7.1): functional reporting to the board is what makes escalation credible and safe.
- Engagement communications (2410, 2440 / 11.x): the engagement report should present management's response and the auditor's view where they differ; the escalation standard operates above the individual report.
- Three Lines Model: management (first and second lines) owns and manages risk; internal audit (third line) provides assurance and insight; the governing body oversees. Escalation is the third line informing the governing body that the first and second lines may be operating outside the agreed boundaries.
7. Worked Scenarios
Scenario A. An audit of IT access controls finds that terminated employees retain system access for an average of 45 days. The CIO responds that the cost of real-time deprovisioning is not justified and accepts the risk. The organization's risk appetite statement classifies unauthorized access to customer data as "zero tolerance." Analysis: the acceptance appears to exceed appetite. The CAE must discuss with senior management (e.g., CEO, CRO). If unresolved, escalate to the audit committee. The CAE should not implement deprovisioning controls or demand the CIO change the response before issuing the report.
Scenario B. Follow-up on a prior audit shows management never implemented an agreed segregation-of-duties fix in a low-value petty cash process. The controller says the exposure is immaterial and has accepted the risk. Analysis: the risk is plausibly within appetite and accepted by an authorized person. The CAE records the acceptance in follow-up documentation and may include it in routine board reporting, but mandatory escalation is not triggered because the risk is not "unacceptable to the organization."
Scenario C. The CAE discusses an unacceptable regulatory compliance risk with the CEO, who agrees it is serious and commits to a funded remediation plan with a three-month timeline. Analysis: the matter is resolved at the senior management level. The CAE should document, monitor implementation through follow-up, and report progress to the board as part of normal reporting. Immediate escalation as an unresolved matter is not required.
Scenario D. The CAE escalates a risk to the audit committee; the committee reviews management's rationale and decides to accept the risk. Analysis: the risk has now been accepted at the appropriate governance level. The CAE's obligation is discharged. The CAE should not continue to escalate or report externally. The CAE should document the board's decision.
8. Exam Tips: Answering Questions on Management Acceptance of Unacceptable Risk
Tip 1 – Identify the actor. The standard places the duty on the CAE, not on the engagement auditor, the audit manager, or the risk manager. If an answer option has the staff auditor escalating directly to the board, it is almost certainly wrong. The correct flow is: auditor informs the CAE; the CAE forms the judgment; the CAE discusses and escalates.
Tip 2 – Memorize the two-step sequence. Senior management first, board second, and only if unresolved. Questions frequently test whether you know that skipping senior management or stopping at senior management when the matter is unresolved are both wrong.
Tip 3 – Watch the word "must." Both the discussion with senior management and the communication to the board are mandatory ("must") when the conditions are met. Options using "may consider" or "at the CAE's discretion" for these steps are weaker than the standard requires.
Tip 4 – Look for the risk appetite anchor. The trigger is risk that may be unacceptable to the organization or that exceeds the organization's risk appetite. If the question stem tells you the risk is within the board-approved appetite, escalation is not required. If the stem references a zero-tolerance area, legal non-compliance, or a threat to objectives the board has prioritized, escalation is likely required.
Tip 5 – Eliminate "auditor resolves the risk" options. Any option where internal audit implements controls, takes ownership, designs the fix, or withholds the report to coerce management is inconsistent with the Interpretation ("it is not the responsibility of the CAE to resolve the risk") and with independence requirements.
Tip 6 – Eliminate premature external reporting. Options involving regulators, external auditors, or public disclosure as the next step are distractors unless the question explicitly involves a legal reporting duty. Standard 2600 / 11.5 is an internal governance escalation.
Tip 7 – Recognize "resolved" correctly. Resolved means the risk has been reduced to an acceptable level, management has credibly committed to action, the CAE has learned the risk is actually within appetite, or an appropriately authorized body has knowingly accepted it. Management simply restating its decision is not resolution.
Tip 8 – Know the sources of identification. If asked how the CAE might become aware of accepted risk, remember: assurance engagements, consulting engagements, follow-up/monitoring of prior engagement actions, and other means. Follow-up is the most frequently tested source.
Tip 9 – Connect to board reporting. If a question asks what the CAE's periodic report to the board should include, significant risk exposures including risks accepted by management is a correct inclusion. Conversely, if a question asks what the CAE should do once the board itself has accepted the risk, the answer is to document the decision and stop escalating.
Tip 10 – Prefer the most direct, standards-based wording. In "best answer" questions, choose the option that most closely mirrors the standard: "discuss the matter with senior management and, if not resolved, communicate it to the board." Longer options that add extra steps (investigate further, obtain legal opinion, re-perform the audit) are usually less correct unless the facts specifically demand them.
Tip 11 – Think in terms of the Three Lines. Ask yourself: who owns the risk (management), who oversees (board), who provides assurance (internal audit)? The right answer will keep each party in its proper role.
Tip 12 – Read for subtle role swaps. Exam writers substitute "audit committee chair" for "senior management" or "CEO" for "board" to test whether you really know the sequence. Slow down and map each option to the escalation path.
9. Quick Practice Questions
Q1. During follow-up, the CAE learns that management has not implemented a corrective action related to a significant data privacy exposure and has decided to accept the risk. The organization's risk appetite statement identifies privacy breaches as intolerable. What should the CAE do first?
A. Report the matter to the data protection regulator.
B. Discuss the matter with senior management.
C. Communicate the matter immediately to the board.
D. Implement compensating controls over the data.
Answer: B. The first required step is discussion with senior management. C is the second step only if unresolved. A and D fall outside the CAE's role.
Q2. After discussing an unacceptable risk with the CEO, the CEO confirms the organization will continue to accept it. The CAE should:
A. Accept the CEO's decision as final because management owns risk.
B. Communicate the matter to the board.
C. Withhold the final engagement report until the CEO changes position.
D. Reassess the finding to reduce its rating.
Answer: B. The matter is unresolved, so escalation to the board is mandatory. A ignores the standard; C and D compromise objectivity.
Q3. Which statement best describes the CAE's responsibility regarding the resolution of an unacceptable risk accepted by management?
A. The CAE must develop and implement a remediation plan.
B. The CAE must ensure the risk is eliminated before the next board meeting.
C. The CAE is not responsible for resolving the risk but must ensure it is communicated to the appropriate level.
D. The CAE must obtain the external auditor's concurrence before escalating.
Answer: C. This mirrors the Interpretation directly.
Q4. The audit committee, having heard the CAE's escalation and management's rationale, votes to accept the risk. What should the CAE do?
A. Escalate the matter to the full board and then to shareholders.
B. Document the committee's decision and consider the matter closed from an escalation standpoint.
C. Issue a qualified opinion on the organization's governance.
D. Resign to protect professional independence.
Answer: B. The risk has been accepted at the appropriate governance level; the CAE's duty is discharged.
10. One-Paragraph Summary to Memorize
When the CAE concludes that management has accepted a level of risk that may be unacceptable to the organization (or exceeds risk appetite), the CAE must discuss the matter with senior management. If the CAE determines the matter is not resolved, the CAE must communicate it to the board. The CAE may identify such risk through assurance engagements, consulting engagements, follow-up, or other means. It is not the CAE's responsibility to resolve the risk; management owns risk and the board oversees it. Internal audit's job is to make sure the right people know, at the right time, with balanced and factual information, and to document that it did so.
Management acceptance of unacceptable risk sits at the intersection of two of the most sensitive relationships in governance: the relationship between internal audit and senior management, and the relationship between internal audit and the board. It is one of the few places in the IIA's standards where the Chief Audit Executive (CAE) is given a mandatory escalation duty that can bypass management and go straight to the board. For that reason it is heavily tested in the CRMA exam, particularly within the Communicating Risk Management Assurance domain.
In practice, the topic matters because:
- Management owns risk and is entitled to accept risk, but the board sets risk appetite and ultimately holds management accountable.
- The board cannot discharge its oversight duty if it is unaware that management is running the organization outside the agreed risk appetite.
- Internal audit is the independent function best positioned to observe the gap between accepted risk and tolerable risk and to make sure it is visible at the right level.
- Failure to escalate exposes the organization, the board and the CAE personally to reputational and professional consequences.
If you understand this topic well, you will also understand how risk appetite, residual risk, follow-up, reporting lines and CAE independence fit together, so it is a high-leverage area to master.
2. What It Is: The Standard in Plain Language
Under the 2017 International Standards (Standard 2600 – Communicating the Acceptance of Risks):
"When the chief audit executive concludes that management has accepted a level of risk that may be unacceptable to the organization, the chief audit executive must discuss the matter with senior management. If the chief audit executive determines that the matter has not been resolved, the chief audit executive must communicate the matter to the board."
The Interpretation adds three crucial points:
- The identification of risk accepted by management may be observed through an assurance or consulting engagement, through monitoring progress on actions taken by management as a result of prior engagements (follow-up), or through other means.
- It is not the responsibility of the CAE to resolve the risk.
- The standard applies to risk that may be unacceptable to the organization, not merely risk the auditor personally dislikes.
Under the 2024 Global Internal Audit Standards (Standard 11.5 – Communicating the Acceptance of Risks):
The requirement is essentially unchanged but is expressed more explicitly in terms of risk appetite: if the CAE concludes that management has accepted a level of risk that exceeds the organization's risk appetite or may be unacceptable to the organization, the CAE must discuss the matter with senior management, and if it is not resolved, must escalate it to the board. The 2024 Standards also make clear that the identification can come from any source, including engagements, follow-up, or other information, and that the CAE must consider whether the matter has been resolved before deciding whether escalation is needed.
Whichever version your exam references, the logic is identical. Learn the sequence and the roles, and you will be able to answer either.
3. Key Definitions You Must Hold in Your Head
- Risk appetite: the level of risk the organization is willing to accept in pursuit of its objectives; set by the board/senior management.
- Risk tolerance: the acceptable variation around objectives; the operational expression of appetite.
- Residual risk: the risk remaining after management has taken action to reduce impact or likelihood. This is the risk that management actually "accepts."
- Risk acceptance: a legitimate risk response in which management consciously decides to retain a risk rather than avoid, reduce, or share it.
- Unacceptable risk: risk that exceeds the organization's appetite or that could threaten the achievement of objectives, compliance, reputation or viability in a way the board would not knowingly tolerate.
- Senior management: the executive level with authority to take corrective action; the first stop in the escalation path.
- The board: the highest governing body (or its designated committee, typically the audit committee); the final stop in the escalation path.
4. How It Works: The Escalation Process Step by Step
Step 1 – Identification. The CAE becomes aware that management has accepted a risk. Sources include: findings in an assurance engagement where management declines to take corrective action; consulting engagement observations; follow-up procedures (Standard 2500 / Standard 15.2) revealing that agreed actions were never implemented; risk register reviews; whistleblower information; or discussions in management committees.
Step 2 – CAE judgment. The CAE, not the engagement auditor, must conclude that the accepted level of risk may be unacceptable to the organization. The test is objective and organizational: is this beyond what the board would knowingly tolerate given stated appetite, strategy, legal obligations and stakeholder expectations? The CAE should consider the risk appetite framework, severity, likelihood, velocity, aggregation with other accepted risks, and whether the acceptance was made by someone with authority to accept it.
Step 3 – Discuss with senior management. This is mandatory and comes first. The purpose is to ensure management fully understands the risk, to confirm whether the acceptance was informed and authorized, to give management the opportunity to reconsider or to provide information that changes the CAE's assessment, and to explore remediation. Many matters are resolved here, either because management acts or because the CAE learns the risk is actually within appetite.
Step 4 – Determine whether the matter is resolved. Resolution means that either the risk has been brought within acceptable levels (management has acted or committed to act credibly), or the CAE is satisfied the risk was never actually unacceptable, or the risk has already been knowingly accepted at an appropriate level of governance (e.g., the board itself approved it). "Resolved" does not mean management simply reaffirmed its decision.
Step 5 – Communicate to the board. If the matter remains unresolved, the CAE must communicate it to the board. This is not optional and does not require management's permission. The communication should be factual, balanced, and should include the nature of the risk, why the CAE considers it potentially unacceptable, management's position and rationale, and the discussions held. The board then decides. The board may agree with management (in which case the risk has been accepted at the correct level of governance and the matter is closed), or may direct action.
Step 6 – Document and move on. The CAE documents the chain of judgment and communications. Internal audit does not implement the fix and does not take ownership of the risk. Internal audit may schedule future follow-up.
5. What the Standard Does NOT Require or Permit
Exam distractors often rely on misunderstanding the boundaries of this standard. Note the following:
- The CAE is not required or permitted to resolve, remediate or own the risk. Doing so would impair independence and objectivity.
- The CAE should not go straight to the board without first discussing the matter with senior management (unless senior management is itself the source of the problem in a way that makes discussion futile or inappropriate, for example suspected executive fraud, which is handled under different considerations).
- The CAE should not report the matter externally to regulators, external auditors, or the press as a first response. External reporting is governed by law, the charter, and board direction, not by Standard 2600 / 11.5.
- The CAE should not refuse to issue the engagement report, withdraw from the engagement, or change the rating to force management's hand.
- The CAE should not accept management's assurance at face value if the facts indicate the risk remains outside appetite.
- The CAE does not need board approval to discuss the matter with senior management, and does not need management approval to escalate to the board.
- Management's acceptance of risk within appetite, after an informed decision by a person with appropriate authority, is a legitimate risk response and does not trigger escalation.
6. Linkages to Other CRMA Concepts
- Risk management assurance: when providing assurance on the effectiveness of the risk management process, the CAE evaluates whether risk acceptance decisions are made at the appropriate level and within appetite. A pattern of unauthorized acceptance is itself a control deficiency in the risk management framework.
- Follow-up (Standard 2500 / 15.2): the CAE must establish a follow-up process and must ascertain that actions have been implemented or that senior management has accepted the risk of not taking action. This is the most common route into Standard 2600 / 11.5.
- Reporting to the board (Standard 2060 / 8.1 and 11.3): the CAE's periodic reporting to the board must include significant risk and control issues, including unacceptable risks accepted by management.
- Independence and organizational positioning (1110 / 7.1): functional reporting to the board is what makes escalation credible and safe.
- Engagement communications (2410, 2440 / 11.x): the engagement report should present management's response and the auditor's view where they differ; the escalation standard operates above the individual report.
- Three Lines Model: management (first and second lines) owns and manages risk; internal audit (third line) provides assurance and insight; the governing body oversees. Escalation is the third line informing the governing body that the first and second lines may be operating outside the agreed boundaries.
7. Worked Scenarios
Scenario A. An audit of IT access controls finds that terminated employees retain system access for an average of 45 days. The CIO responds that the cost of real-time deprovisioning is not justified and accepts the risk. The organization's risk appetite statement classifies unauthorized access to customer data as "zero tolerance." Analysis: the acceptance appears to exceed appetite. The CAE must discuss with senior management (e.g., CEO, CRO). If unresolved, escalate to the audit committee. The CAE should not implement deprovisioning controls or demand the CIO change the response before issuing the report.
Scenario B. Follow-up on a prior audit shows management never implemented an agreed segregation-of-duties fix in a low-value petty cash process. The controller says the exposure is immaterial and has accepted the risk. Analysis: the risk is plausibly within appetite and accepted by an authorized person. The CAE records the acceptance in follow-up documentation and may include it in routine board reporting, but mandatory escalation is not triggered because the risk is not "unacceptable to the organization."
Scenario C. The CAE discusses an unacceptable regulatory compliance risk with the CEO, who agrees it is serious and commits to a funded remediation plan with a three-month timeline. Analysis: the matter is resolved at the senior management level. The CAE should document, monitor implementation through follow-up, and report progress to the board as part of normal reporting. Immediate escalation as an unresolved matter is not required.
Scenario D. The CAE escalates a risk to the audit committee; the committee reviews management's rationale and decides to accept the risk. Analysis: the risk has now been accepted at the appropriate governance level. The CAE's obligation is discharged. The CAE should not continue to escalate or report externally. The CAE should document the board's decision.
8. Exam Tips: Answering Questions on Management Acceptance of Unacceptable Risk
Tip 1 – Identify the actor. The standard places the duty on the CAE, not on the engagement auditor, the audit manager, or the risk manager. If an answer option has the staff auditor escalating directly to the board, it is almost certainly wrong. The correct flow is: auditor informs the CAE; the CAE forms the judgment; the CAE discusses and escalates.
Tip 2 – Memorize the two-step sequence. Senior management first, board second, and only if unresolved. Questions frequently test whether you know that skipping senior management or stopping at senior management when the matter is unresolved are both wrong.
Tip 3 – Watch the word "must." Both the discussion with senior management and the communication to the board are mandatory ("must") when the conditions are met. Options using "may consider" or "at the CAE's discretion" for these steps are weaker than the standard requires.
Tip 4 – Look for the risk appetite anchor. The trigger is risk that may be unacceptable to the organization or that exceeds the organization's risk appetite. If the question stem tells you the risk is within the board-approved appetite, escalation is not required. If the stem references a zero-tolerance area, legal non-compliance, or a threat to objectives the board has prioritized, escalation is likely required.
Tip 5 – Eliminate "auditor resolves the risk" options. Any option where internal audit implements controls, takes ownership, designs the fix, or withholds the report to coerce management is inconsistent with the Interpretation ("it is not the responsibility of the CAE to resolve the risk") and with independence requirements.
Tip 6 – Eliminate premature external reporting. Options involving regulators, external auditors, or public disclosure as the next step are distractors unless the question explicitly involves a legal reporting duty. Standard 2600 / 11.5 is an internal governance escalation.
Tip 7 – Recognize "resolved" correctly. Resolved means the risk has been reduced to an acceptable level, management has credibly committed to action, the CAE has learned the risk is actually within appetite, or an appropriately authorized body has knowingly accepted it. Management simply restating its decision is not resolution.
Tip 8 – Know the sources of identification. If asked how the CAE might become aware of accepted risk, remember: assurance engagements, consulting engagements, follow-up/monitoring of prior engagement actions, and other means. Follow-up is the most frequently tested source.
Tip 9 – Connect to board reporting. If a question asks what the CAE's periodic report to the board should include, significant risk exposures including risks accepted by management is a correct inclusion. Conversely, if a question asks what the CAE should do once the board itself has accepted the risk, the answer is to document the decision and stop escalating.
Tip 10 – Prefer the most direct, standards-based wording. In "best answer" questions, choose the option that most closely mirrors the standard: "discuss the matter with senior management and, if not resolved, communicate it to the board." Longer options that add extra steps (investigate further, obtain legal opinion, re-perform the audit) are usually less correct unless the facts specifically demand them.
Tip 11 – Think in terms of the Three Lines. Ask yourself: who owns the risk (management), who oversees (board), who provides assurance (internal audit)? The right answer will keep each party in its proper role.
Tip 12 – Read for subtle role swaps. Exam writers substitute "audit committee chair" for "senior management" or "CEO" for "board" to test whether you really know the sequence. Slow down and map each option to the escalation path.
9. Quick Practice Questions
Q1. During follow-up, the CAE learns that management has not implemented a corrective action related to a significant data privacy exposure and has decided to accept the risk. The organization's risk appetite statement identifies privacy breaches as intolerable. What should the CAE do first?
A. Report the matter to the data protection regulator.
B. Discuss the matter with senior management.
C. Communicate the matter immediately to the board.
D. Implement compensating controls over the data.
Answer: B. The first required step is discussion with senior management. C is the second step only if unresolved. A and D fall outside the CAE's role.
Q2. After discussing an unacceptable risk with the CEO, the CEO confirms the organization will continue to accept it. The CAE should:
A. Accept the CEO's decision as final because management owns risk.
B. Communicate the matter to the board.
C. Withhold the final engagement report until the CEO changes position.
D. Reassess the finding to reduce its rating.
Answer: B. The matter is unresolved, so escalation to the board is mandatory. A ignores the standard; C and D compromise objectivity.
Q3. Which statement best describes the CAE's responsibility regarding the resolution of an unacceptable risk accepted by management?
A. The CAE must develop and implement a remediation plan.
B. The CAE must ensure the risk is eliminated before the next board meeting.
C. The CAE is not responsible for resolving the risk but must ensure it is communicated to the appropriate level.
D. The CAE must obtain the external auditor's concurrence before escalating.
Answer: C. This mirrors the Interpretation directly.
Q4. The audit committee, having heard the CAE's escalation and management's rationale, votes to accept the risk. What should the CAE do?
A. Escalate the matter to the full board and then to shareholders.
B. Document the committee's decision and consider the matter closed from an escalation standpoint.
C. Issue a qualified opinion on the organization's governance.
D. Resign to protect professional independence.
Answer: B. The risk has been accepted at the appropriate governance level; the CAE's duty is discharged.
10. One-Paragraph Summary to Memorize
When the CAE concludes that management has accepted a level of risk that may be unacceptable to the organization (or exceeds risk appetite), the CAE must discuss the matter with senior management. If the CAE determines the matter is not resolved, the CAE must communicate it to the board. The CAE may identify such risk through assurance engagements, consulting engagements, follow-up, or other means. It is not the CAE's responsibility to resolve the risk; management owns risk and the board oversees it. Internal audit's job is to make sure the right people know, at the right time, with balanced and factual information, and to document that it did so.
Test mode:
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3053 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Management Acceptance of Unacceptable Risk questions
22 questions (total)
Other Communicating Risk Management Assurance concepts
Communicating Emerging Risks to Senior ManagementCommunicating Risk Management EffectivenessCriteria, Condition, Cause, and Effect in FindingsDeveloping the Engagement ReportEscalating Risk Acceptance to the BoardEvaluating Management Responses to Key RisksMonitoring and Follow-Up of Engagement ResultsObtaining Management Responses and Action PlansOverall Opinions on Risk ManagementPlanning Engagement CommunicationsReporting to the Audit Committee on RiskTailoring Risk Communications to AudiencesThe Exit Conference