CIA governance and risk: who owns, oversees and assesses?
Management owns the organization’s activities and risks, the board provides oversight, and internal audit supplies independent assurance and advice. A good CIA answer keeps those roles distinct, then separates inherent risk, controls and residual risk.
- Board
Primary role in this modelOversee direction, accountability and risk governance
Supplier-risk exampleChallenge significant unresolved exposure
- Management
Primary role in this modelRun operations and manage their risks
Supplier-risk exampleApprove supplier controls and implement fixes
- Internal audit
Primary role in this modelIndependently evaluate and advise
Supplier-risk exampleTest whether the controls address the risk
Follow risk through the control
Inherent risk describes exposure before considering controls. Residual risk is what remains after their effect. A control can reduce likelihood, impact or both, but its existence does not prove effective operation.
- 1
Objective
Only legitimate suppliers are paid.
Output: A defined outcome
- 2
Inherent risk
One employee can create and pay a supplier.
Output: Exposure before the safeguard
- 3
Control
Independent setup approval is required.
Output: A designed response
- 4
Residual risk
Collusion or override can still occur.
Output: Exposure remaining after controls
Distinguish oversight, ownership and independent assessment
In an illustrative supplier process, management chooses how suppliers are approved and pays for the controls. The board oversees the organization’s direction and significant risk governance. Internal audit evaluates relevant controls and communicates supported conclusions. The roles can interact without becoming interchangeable.
When a scenario asks who should implement a corrective control, choose the operational decision owner. When it asks who independently evaluates whether that response works, the responsibility changes. A senior title or detailed knowledge of the process does not, by itself, answer which role the question requires.
Appetite and tolerance provide context for the remaining risk
Risk appetite concerns the types and amount of risk an organization is willing to accept in pursuing objectives. Tolerance makes acceptable variation or exposure more specific in the relevant context. The terms guide judgment; they are not universal numeric thresholds that an auditor invents after testing.
Suppose a business accepts some disruption while entering a new market but sets a specific limit on unresolved high-risk supplier exceptions. Compare the remaining exposure with the established expectations and actual facts. Internal audit can evaluate and communicate a concern without taking over management’s acceptance decision.
Use an inherent-to-residual narrative
Describe what could happen without the response, what the control is intended to change, and what exposure remains. Independent setup approval may reduce unilateral misuse, but collusion, override or weak review can leave risk. A zero in a risk spreadsheet is not proof that no exposure remains.
Do not mechanically subtract ordinal labels such as “high” minus “medium.” Explain the mechanism and evidence. If numeric estimates are used in a scenario, identify their assumptions and limitations before treating the result as precise. The useful question is how the response changes the risk, not whether the arithmetic looks tidy.
Classify a control by when it acts
A control’s purpose matters more than its name. Determine whether it prevents the event, detects it after occurrence or helps correct the consequence. Then evaluate whether the chosen control addresses the actual risk.
| Type | Example | Question to ask |
|---|---|---|
| Preventive | Independent approval before supplier activation | Can an unauthorized supplier be created anyway? |
| Detective | Review of duplicate bank-account details | Is the exception investigated promptly? |
| Corrective | Disable a fraudulent account and repair the process | Does the response address the cause? |
Preventive
- Example
- Independent approval before supplier activation
- Question to ask
- Can an unauthorized supplier be created anyway?
Detective
- Example
- Review of duplicate bank-account details
- Question to ask
- Is the exception investigated promptly?
Corrective
- Example
- Disable a fraudulent account and repair the process
- Question to ask
- Does the response address the cause?
Design and operation fail in different ways
A control is poorly designed if, even performed as intended, it would not adequately address the relevant risk. A well-designed control can still fail in operation if it is bypassed, applied inconsistently or performed without meaningful review. Identify which problem the facts support before choosing a correction.
For example, requiring a second approval may be sensible, but allowing the preparer to use both approval accounts defeats the intended separation. Simply reminding staff to complete the form may leave the access weakness untouched. A useful response addresses how the failure is possible.
A detective control must lead somewhere
A weekly duplicate-payment report may detect a problem, but producing the report is only one step. Consider completeness of the data, who reviews exceptions, how quickly they act and what happens when the same issue recurs. A report that nobody investigates may look like a control without changing the exposure.
Similarly, a corrective action should address the cause as well as the immediate consequence. Recovering one improper payment helps with that event; revising the access or approval weakness may be needed to reduce recurrence. Distinguish evidence of recovery from evidence that the underlying process improved.
Advice must preserve the ability to assess
Audit can recommend improvements and facilitate discussion. Taking ongoing operational decisions can impair the independence or objectivity needed to assess the same area. Identify the decision owner before choosing a helpful-sounding action.
Helpful advice can cross a responsibility boundary
An auditor might facilitate a workshop on supplier risks and explain alternative controls. Management should evaluate and own the operating choice. If the auditor becomes the ongoing approver, later assurance on those approvals introduces self-review concerns. The fact that the business asked for help does not remove the concern.
In a case answer, state the threatened responsibility and the need for appropriate disclosure, assignment or safeguards rather than assuming either total withdrawal from advice or unrestricted participation. The response should fit the role and circumstances described.
A complete risk explanation in five sentences
Try this writing drill: name the business objective, describe the event that threatens it, identify who owns the response, explain the control mechanism and state what remains uncertain after the evidence. If you cannot complete one sentence, you have found the next question to investigate.
For a new supplier scenario, the uncertainty might be whether approvals operated or whether emergency exceptions bypassed them. Those uncertainties lead to different evidence. This drill connects the vocabulary to a concrete decision without requiring a long generic definition in every answer.
Original worked case
Control design versus control operation
A policy requires a second approval for payments above a threshold. Testing finds that the system allows the original preparer to supply both approvals.
Reveal the decision and reasoning
The written design expresses a separation, but the operating mechanism does not enforce independent approval. Investigate the actual access and approval records.
A policy document is evidence of intent. It does not by itself show that the intended safeguard operated.
An editorial teaching example, not an official IIA question or a prediction of exam content.
Common questions
- Can internal audit own a business risk?
- Audit ordinarily evaluates and advises while management retains operational risk ownership. An assignment that transfers management responsibility requires attention to independence and safeguards.
- Does a strong control remove all risk?
- No. Override, collusion, changing conditions and control failures can leave residual exposure.
Sources and editorial notes
Official exam facts and provider package descriptions are supported by the references below. Study schedules, scenarios and fit judgments are our editorial work. They do not establish a required study duration, a pass probability or comparative learning outcomes.
- The IIA: Part 1 expanded syllabus
- Governance, risk, control and responsibility outcomes.
- Assurance/advisory distinctions and independence threats.
- The IIA: Global Internal Audit Standards
- Governance and independent internal audit responsibilities.
MiloPrep is independent and is not affiliated with or endorsed by The IIA or the providers discussed. Product comparisons describe our own offering alongside provider information. Names and marks belong to their owners.