An internal auditor assessed that the risk of steel theft at a plant is high. In response, the plant’s management introduced a number of controls, including fences around the facility, a metal detector at the entrance, and monthly steel inventory counts. If the controls operate as intended, which of the following outcomes would the internal auditor hope to see?
When the plant’s management introduces controls to mitigate the risk of steel theft, the objective is to reduce the risk that remains after these controls are applied, known as the residual risk, to an acceptable level. The inherent risk refers to the risk level without any controls in place, which cannot be changed by implementing controls. Therefore, the correct outcome the internal auditor would hope to see is that the residual risk will be reduced to an acceptable level.
C is correct
I feel it is C
I also feel it is C
shouldn't it be c?