Who should escalate unresolved unacceptable risk to the board?

author: AcadiFi Team

Answer:

The CAE is normally responsible for communicating unresolved unacceptable risk to the board. Staff auditors and engagement leads should escalate internally through the engagement supervisor or CAE so the issue can be evaluated consistently against evidence, criteria, risk appetite, and the audit function's methodology.

That does not mean staff auditors stay silent. They should document the issue, preserve evidence, communicate through the engagement chain, and make sure the CAE understands why the residual risk may exceed appetite.

The CIA logic is governance discipline. Internal audit needs independence and board access, but the audit function also needs controlled, accurate, and authorized communication.