During an audit, a staff internal auditor observed that management’s acceptance of residual risk was marginally beyond the organization’s risk tolerance. Which...