Residual risk is the risk that remains after management has taken steps to mitigate or control the inherent risks. The chief audit executive (CAE) performs residual risk assessment to determine the effectiveness of management's actions and whether the remaining risk is acceptable.
Detailed Explanation:
IIA Standard 2120 - Risk Management:
The standard emphasizes that the CAE should evaluate the residual risks faced by the organization. This involves assessing whether management's risk responses are adequate and whether any unmitigated risks (residual risks) remain within the organization's risk tolerance.
Cost-Benefit Analysis:
Conducting a cost-benefit analysis of management's decision not to implement a recommendation directly relates to assessing residual risk. This analysis helps determine whether the residual risk is acceptable compared to the cost of implementing the recommendation.
IIA Practice Guide on Assessing Residual Risk:
This guide outlines that assessing residual risk involves evaluating the impact of management's controls and the risks that remain. A cost-benefit analysis is a method to quantify the impact of not addressing a recommendation, thereby evaluating the residual risk.
Why Not Other Options?
Option B (Inquiry of corrective action to be completed): This is more about monitoring follow-up actions rather than assessing residual risk.
Option C (Reporting status of every observation): While important, this is related to tracking audit issues, not specifically assessing residual risk.
Option D (Soliciting management's feedback): While valuable for engagement quality, this does not directly relate to residual risk assessment.
Conclusion: Option A is correct as it reflects the CAE's role in assessing residual risk through cost-benefit analysis, in line with IIA standards.