In the risk control map, Risk C is positioned in the upper left quadrant, indicating it is critical (high risk significance) but with a low level of control.
This suggests that the current controls are insufficient to mitigate the high level of risk associated with Risk C.
For critical risks, a higher level of control is necessary to ensure that the risk is properly managed and mitigated.
References:
* "Internal Auditing: Assurance & Advisory Services" (The Institute of Internal Auditors)
* "Risk Management Framework" (COSO)

Section: Volume E

According to the International Standards for the Professional Practice of Internal Auditing, particularly Standard 2420 - Quality of Communications, internal audit communications should be accurate, objective, clear, concise, constructive, complete, and timely. Ensuring that communications are relevant, logical, and free from errors is essential for maintaining the credibility and effectiveness of the internal audit function and for providing management with reliable information for decision-making.
Reference:
Institute of Internal Auditors (IIA), International Standards for the Professional Practice of Internal Auditing (Standards), Standard 2420 - Quality of Communications.

Section: Volume B