Finding F38
Internal Audit’s risk assessment methodology does not comply with IIA Standards 9.3 and 9.4 because it does not include documented scoring criteria, risk-weighting factors, a defined process for gathering risk information, or evidence of management input.
Jury report: BART at a Crossroads: Structural Deficit, Governance Accountability, and the Choices Ahead · PDF page 24
Permanent linkOfficial response
BART Board of Directors
Partially disagrees: prior assessments used impact/likelihood scoring and management surveys; methodology can be better documented.
Read official response · PDF page 17Engages scoring, weighting, information gathering and input using IIA9.3/9.4 and identified assessment methods.
This review evaluates the response document. Implementation claims have not been independently verified.