A manufacturer keeps a risk register with 180 entries, all rated "medium," last updated 14 months ago. The process exists. The exam question is whether it works.
Internal audit evaluates risk management. It does not own it. Management owns risk and operates the process; the board oversees it; internal audit provides assurance on whether the process is designed well and running as designed. Getting that split right answers a large share of exam items on this objective.
Two distinct evaluations sit inside this work:
- Design evaluation: Would the process identify, assess, respond to, and monitor risk if it operated exactly as documented?
- Effectiveness evaluation: Does the process actually operate that way, and does it produce risk information management uses?
KEY: Design and effectiveness fail independently. A well-designed framework nobody executes fails on effectiveness. A diligently executed process that never considers strategic risk fails on design. Read the stem for which one is broken.
Design evaluation asks whether the architecture can work. You test the architecture against a small set of questions.
Common mistakes
- Confusing ownership with evaluation. Management owns and operates risk management; internal audit assures it. Answer choices where internal audit sets appetite or assigns risk responses are wrong.
- Treating a current register as effectiveness evidence. Formatting and refresh dates prove activity, not that ratings are supported or that materialized losses were captured.
- Accepting self-asserted control effectiveness. A 60% effectiveness claim that testing does not support turns a residual of 8 into 15 and flips the tolerance conclusion.
Bottom line
- Management owns and operates risk management, the board oversees it, and internal audit evaluates its design and effectiveness.
- Design asks whether the process could work: objectives linkage, category coverage, consistent criteria, assigned responses and owners, monitoring and reporting cadence.
- Effectiveness asks whether it does work: corroborate ratings with loss and incident data, verify treatment execution, confirm board reporting occurred.
- Residual risk equals inherent risk times one minus control effectiveness; tolerance is always compared against residual, never inherent.
Exam shortcut
Sort the stem into design or effectiveness before reading the answers. Words like "missing category," "no appetite statement," "no owner assigned," or "no reporting route" mean design. Words like "not updated," "ratings unsupported," "plan never executed," or "loss occurred but was never on the register" mean effectiveness.
The full lesson (about 2,085 words, 14 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 6
Browse all free CIA Part 1 lessons or jump into free CIA Part 1 practice questions.