During its assessment of the accounts payable department, the internal audit function identified the following observation:

Inadequate segregation of duties over certain information system access controls. Potential risk exposure is $45 million.

Based on the context in which the observations occur, management and the internal audit function agree on the potential loss exposure represented by these observations.

The organization has a risk management function that, together with the independent outside auditor, has determined that an amount less than $20 million dollars is insignificant in impact and that an amount greater than $80 million is material in impact.

Based on these facts, classify the observation. Please select three correct answers.

Group of answer choices

Adequate in design

Not adequate in design

Operating effectively

Not operating effectively

Significant

Insignificant