Which finding indicates a potential deficiency in an organization’s internal control framework?

Excluding IT management from a risk assessment involving IT systems indicates a potential weakness because individuals with relevant responsibility and expertise should participate in identifying and assessing risks within their areas. IT management possesses essential knowledge of system architecture, cybersecurity threats, availability requirements, data protection, operational dependencies, and technology controls. Without this input, material IT risks could be overlooked or incorrectly evaluated. Scheduling internal audits less frequently can be reasonable when justified by a documented low-risk environment. Avoiding high-risk opportunities is a legitimate risk response, and using third-party providers is also acceptable when associated third-party risks are appropriately managed. Therefore, those circumstances do not inherently demonstrate control deficiencies. Failure to involve appropriate IT stakeholders in an IT-related risk assessment undermines the completeness and quality of the organization’s risk assessment process.