An internal audit engagement team found that the risk register of the project under review did not include significant risks identified by the…

The root cause of the missing significant risks lies in the methodology used for risk identification. If

the process relies too rigidly on a standard set of questions, it may overlook critical risks. By revising

the risk identification methodology, the organization ensures that future projects capture relevant

risks comprehensively and consistently, adding long-term value.

Option A addresses only the current project, not the underlying issue. Option B may improve

knowledge but does not fix the flawed process. Option D merely shifts responsibility but does not

address the methodology weakness.

Reference:

IIA Standards – Standard 2120: Risk Management.