According to IIA guidance, an appropriate role for the internal audit activity with regard to the organization's risk management program is to attain an adequate understanding of the organization's key risk mitigation strategies. This enables internal auditors to evaluate the effectiveness of risk management processes and provide assurance on the adequacy of risk controls. Identifying and managing risks, ensuring risk management processes exist, and ensuring controls exist to mitigate risks are responsibilities of management, not internal audit.
References:
IIA Standards: 2120 - Risk Management
IIA Practice Guide: Internal Audit's Role in Risk Management
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit