A significant governance issue that must be reported to the board is the absence of a formal risk management and control process, with risk management being solely the responsibility of operational managers. Effective governance requires a structured risk management framework overseen at the highest levels of the organization. The lack of such a process indicates a critical deficiency that can have severe implications for the organization's ability to manage and mitigate risks.
Reference:
The Institute of Internal Auditors (IIA) Standard 2110 - Governance: "The internal audit activity must assess and make appropriate recommendations to improve the organization's governance processes."