Recommendation R12
By January 1, 2027, the Auditor-Controller should consider requiring the IAD to adopt and implement a documented risk assessment methodology that includes defined risk factors, risk-ranking or scoring criteria, and a systematic process for identifying and prioritizing risks as required by IIA Standards 9.3 and 9.4.
Jury report: Contra Costa County’s Internal Audit Division: Time for a Transformation · PDF page 15
Permanent linkOfficial response
Contra Costa County Auditor-Controller
Agency plans to implementWill implement a documented IIA risk-assessment methodology by April 1, 2027.
Read official response · PDF page 6Agency date is three months later than the recommendation’s January 1 date.
- Implement documented risk-assessment methodology aligned with IIA. Owner: Contra Costa County Auditor-Controller. Timing: 2027-04-01.
This review evaluates the response document. Implementation claims have not been independently verified.