Which of the following best describes the chief audit executive's responsibility for assessing the organization's...

The CAE’s role is to provide assurance that risks are identified and managed appropriately. When residual risk appears to exceed the organization’s tolerance, the CAE should first communicate the matter with senior management to discuss the issue and understand management’s acceptance of risk. Only if the risk remains unresolved should it be escalated to the board.

Option A is management’s responsibility, not internal audit’s. Option B is incomplete as evidence alone does not fulfill the communication requirement. Option C is premature because immediate escalation to the board skips management dialogue.