IIA Updated IIA-CIA-Part3 Exam Questions and Answers by rahma

Best practice and accounting standards require that receivables unlikely to be collected be written off to avoid overstating assets. Internal audit should recommend that management review the receivables and write off uncollectible debts accordingly.

Option A (escalation to the board) is premature; it should first be addressed with management. Option B (removing from cash flow statement) is not correct because write-offs affect the balance sheet and income statement, not just cash flows. Option D ignores a material risk of misstated financial statements.

Organizational governance concerns the structures, processes, and relationships used to direct, manage, and oversee an organization. Governance participants are accountable primarily to stakeholders, which may include shareholders, the board, regulators, employees, citizens, donors, and other parties affected by the organization’s objectives. Saying that those performing governance activities are accountable only to the customer is inaccurate and too narrow. Customers are important stakeholders, but they are not the sole accountability group in governance. An effective internal audit function supports governance by providing independent assurance on risk management, controls, ethics, compliance, and performance. Accountability is a core governance principle, and governance applies to private, public, governmental, and not-for-profit entities. Therefore, the statement in Option B is the one that is not correct.

According to IIA guidance, the CAE must escalate to the board when significant risks remain unaddressed. The most critical concern here is that no resources or budget were allocated to implement corrective measures. This indicates that management is not taking the risk seriously, and the exposure to noncompliance with data protection laws remains high.

Option A relates to customer satisfaction, not regulatory compliance. Option C is an issue of communication but not as critical as failing to allocate resources. Option D shows resistance but can be managed if resources are in place.

Thus, the condition that best justifies escalation is Option B: lack of allocated resources.

A comprehensive risk management strategy focuses on identifying, assessing, responding to, and monitoring risks that could prevent the organization from achieving objectives. The mindset of mitigating losses is broader than focusing only on shareholder value, market share, or operational efficiency. Increasing shareholder value may be a strategic objective, but it can encourage excessive risk-taking if not balanced with risk tolerance. Maximizing market share is too narrow and may ignore profitability, compliance, and control risks. Improving operational efficiency is valuable but does not address strategic, financial, compliance, technology, and reputational risk. Mitigating losses captures the broader risk management intent of reducing adverse outcomes within acceptable tolerance. Internal audit should assess whether risk management considers the full risk universe, not one performance target. Therefore, Option D is correct.