An internal audit engagement team found that the risk register of the project under review did not include significant risks identified by the…

The finding indicates a systemic weakness in the project risk identification methodology, as it relies on a standard set of questions that failed to identify significant risks. Simply updating one project's register (A) is a corrective action for a symptom, not the root cause. Recommending a revision to the methodology (C) addresses the underlying process deficiency. This provides the greatest value by enhancing the risk management process for all future projects, preventing recurrence of the issue and improving the organization's overall risk management maturity.

A. This is a necessary corrective action for the specific project but does not address the flawed process that caused the omission.
B. The issue is with the project-level methodology, not necessarily a lack of senior management's understanding of risk principles.
D. Changing who completes the register does not fix the inadequate methodology they are required to use. The process itself is the problem.

1. The Institute of Internal Auditors (IIA). (2020). IIA Practice Guide: Auditing Risk Management. 2nd Ed. Section 3.2, "Evaluating the Risk Management Process." The guide emphasizes evaluating the design and effectiveness of risk management processes, including risk identification.

2. Fraser, J., & Simkins, B. (2016). The challenges of and solutions for implementing enterprise risk management. Business Horizons, 59(6), 689-698. https://doi.org/10.1016/j.bushor.2016.06.007 (Discusses the importance of robust risk identification processes as a cornerstone of effective ERM).

3. COSO. (2017). Enterprise Risk Management—Integrating with Strategy and Performance. Principle 10: Identifies Risk. "The organization identifies new, emerging, and changing risks to the achievement of strategy and business objectives." A flawed methodology impairs this ability.