A practice's board does not evaluate risk exposure. What governance gap exists?

• A. Risk Oversight Deficiency
• B. Compliance Gap
• C. Operational Risk
• D. Financial Risk

Answer: (A)

Risk oversight deficiency is the governance gap involved. The board is responsible for overseeing risk: understanding the organization’s risk exposures, monitoring how those risks are being managed, and ensuring there are effective processes to identify, assess, and mitigate them. When the board does not evaluate risk exposure, there’s a breakdown in governance over risk—influence over strategic risk, operational risk, and how the organization responds to potential threats. Without this oversight, risk management can drift, controls may be weaker, and the entity may face unexpected losses or strategic missteps.

Compliance gap would imply failing to meet laws or regulations, which is not the same as neglecting risk oversight. Operational risk describes a category of risk from internal processes, not a governance shortcoming. Financial risk is another risk category related to monetary exposure, not a governance deficiency.