Skip to content
Grand Jury Hub
← Back to this finding in the response audit
Public discussion · Finding BART2608-F38

F38: Internal Audit’s risk assessment methodology does not comply with IIA Standards 9.3 and 9.4 because it does not include documented scoring criteria, risk-weighting factors, a defined process for gathering risk information, or evidence of management input.

What should residents consider about Finding BART2608-F38: F38: Internal Audit’s risk assessment methodology does not comply with IIA Standards 9.3 and 9.4 because it does not include documented scoring criteria, risk-weighting factors, a defined process for gathering risk information, or evidence of management input., and the County’s response?

BART Board of DirectorsAudit assessment: Addressed
Participate in this discussion

Audit context

What the response says and how it was assessed

Response says

Partially disagrees: prior assessments used impact/likelihood scoring and management surveys; methodology can be better documented.

Audit analysis

Engages scoring, weighting, information gathering and input using IIA9.3/9.4 and identified assessment methods.

Finding-response score

Document completeness and usefulness—not factual verification or a legal conclusion.

10/10

4/4

Statutory elements

Stated position
2/2
Applicable disagreement elements
2/2

6/6

Public usefulness

Coverage
2/2
Reason specificity
2/2
Support traceability
2/2

Engages scoring, weighting, information gathering and input using IIA9.3/9.4 and identified assessment methods.

Scoring confidence: high