フリー問題

問題文

A proposed control would cost two hundred thousand a year to operate and would reduce an exposure that the risk assessment values at fifteen thousand a year. Management declines to implement it. How should the auditor treat this?

選択肢

1. Accept that the control cost exceeds the reduced exposure, record the acceptance decision, and confirm that the residual risk sits with the accountable authority of the organization.
2. Accept that the reduced exposure exceeds the control cost, record the rejected proposal, and confirm that the residual risk sits with the accountable level of the organization.
3. Accept that the control cost exceeds the reduced exposure, record the rejected proposal, and confirm that the detection risk sits with the accountable level of the organization.
4. Accept that the reduced exposure exceeds the control cost, record the acceptance decision, and confirm that the detection risk sits with the accountable level of the organization.