An engagement produces 14 observations across four processes. Management calls them minor. The chief audit executive has to decide whether the aggregate picture leaves risk inside appetite or above it, and then say so in one word. That is the purpose of a rating scale for the overall control assessment.
Inherent risk is exposure before any control acts on it. Residual risk is what remains after existing controls operate as designed and in practice. The gap between them is control effect. Assessing residual risk on an engagement means measuring that gap with evidence, not accepting management's assertion about it.
The chief audit executive (CAE) owns the residual-risk conclusion for the engagement. Engagement auditors test and document; the CAE forms and communicates the assessment of the effectiveness of residual risk treatment, because that is what senior management and the board rely on.
Common mistakes
- Rating by finding count. Twelve trivial observations do not outrank one design gap that leaves payment diversion uncontrolled. The rating tracks residual risk against appetite.
- Testing operation before design. Sampling 60 items on a control that reconciles the wrong population burns budget and produces a false comfort conclusion.
- Treating aggregation as averaging. Six low-severity access defects sharing one broken provisioning process aggregate up to significant. They do not average down to low.
Bottom line
- Residual risk is inherent risk less the effect of controls that are both adequately designed and operating effectively.
- Design first: an inadequately designed control leaves residual risk at or near inherent no matter how well it is operated.
- Operating effectiveness testing sizes the shortfall when design is adequate; failure rate and compensating controls set how far residual risk sits above the designed target.
- Aggregation groups observations by root cause to expose systemic patterns, sum exposure, support the overall conclusion, and prevent double counting.
Exam shortcut
Read the stem for two words before anything else: "designed" and "operating." If the facts attack design, no exception rate saves the answer, and the correct choice names redesign. If design is fine and only execution slipped, the correct choice names retraining, monitoring, or supervision.
The full lesson (about 2,267 words, 15 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 5
Browse all free CIA Part 3 lessons or jump into free CIA Part 3 practice questions.