Escalate to the right level

Exam

CISA & CISM

What it means

When something exceeds your authority or the risk appetite, the answer is usually to escalate to the person or body who can decide: the risk owner, senior management, or the audit committee.

The trap answer looks like

Accept the risk yourself, ignore it, or fix it quietly to avoid conflict.

The winning answer looks like

Inform the person or body with authority to decide: the risk owner, senior management or the audit committee.

Worked example

A business owner refuses both to fund mitigation and to accept a risk above appetite.

✅ Escalate to senior management for a decision

Someone with authority must own the decision. Deadlock is not a decision.