Advisory and Consulting Services on Risk Management
5 minutes
5 Questions
Within the Certification in Risk Management Assurance (CRMA) framework, internal auditors are recognized not only for providing independent assurance over risk management but also for delivering advisory and consulting services that help organizations strengthen their risk management capabilities. Advisory and consulting services are activities performed at the request of management, where the nature and scope are agreed upon in advance, and where the internal audit function offers insight, facilitation, training, or recommendations without assuming management responsibility for risk decisions. Typical advisory roles include facilitating risk identification and assessment workshops, coaching management on developing risk responses, advising on the design of control frameworks, supporting the implementation of enterprise risk management (ERM), and helping integrate risk management into strategic planning and governance processes. Internal auditors may also champion the development of a risk-aware culture and provide education on emerging risks, regulatory expectations, and risk appetite concepts. The IIA's Three Lines Model and the Global Internal Audit Standards emphasize that these services must be delivered while safeguarding independence and objectivity. The Standards require that auditors must not set risk appetite, impose risk management processes, make decisions on risk responses, implement responses on management's behalf, or assume ownership or accountability for risk. When auditors provide significant consulting on a risk area, they should disclose this and, where necessary, arrange for assurance work on that area to be performed by others or after an appropriate cooling-off period. The value of advisory services lies in leveraging internal audit's enterprise-wide perspective, control expertise, and analytical skills to help the organization mature its risk management practices, particularly in less developed environments. The Chief Audit Executive must ensure such engagements are documented in the audit charter, approved by the board or audit committee, properly resourced, and communicated clearly so stakeholders understand the distinction between assurance conclusions and advisory recommendations. Effective balance between the two roles enhances organizational governance while preserving the credibility of internal audit's independent assurance mandate.
Advisory and Consulting Services on Risk Management: A Complete CRMA Study Guide
1. Why This Topic Matters
Internal audit is no longer confined to telling management what went wrong after the fact. Boards and executives increasingly expect the internal audit activity to help the organization build effective risk management, not merely to assess it. This creates a tension that sits at the heart of the CRMA syllabus: how can internal audit help design, facilitate, and improve risk management processes while remaining independent and objective enough to provide assurance on those same processes later?
The CRMA exam tests this topic heavily because it is where theory meets judgment. Candidates must understand the difference between assurance and consulting, know which roles internal audit may legitimately perform in enterprise risk management (ERM), recognize the roles it must never perform, and apply the safeguards the IIA requires. Questions in this area are rarely about memorizing definitions; they present scenarios and ask what the chief audit executive (CAE) or internal auditor should do. Mastering this topic therefore improves your performance on a large share of situational questions across the entire exam.
2. What Advisory and Consulting Services on Risk Management Are
The IIA defines consulting services as advisory and related client service activities, the nature and scope of which are agreed with the client, intended to add value and improve an organization's governance, risk management, and control processes without the internal auditor assuming management responsibility. Examples include counsel, advice, facilitation, and training. In the 2024 Global Internal Audit Standards the term advisory services is used, but the concept is identical.
Contrast this with assurance services: an objective examination of evidence to provide an independent assessment on governance, risk management, and control processes. Three key differences you must know:
- Parties involved: Assurance has three parties (process owner, internal auditor, user). Consulting has two parties (the internal auditor and the engagement client).
- Who decides scope: In assurance, the internal auditor determines nature and scope. In consulting, nature and scope are agreed with the client.
- Nature of the output: Assurance produces an independent opinion or conclusion. Consulting produces advice and recommendations that management is free to accept or reject.
Common forms of risk-related consulting include:
- Formal consulting engagements that are planned and documented, such as helping design a risk register or risk appetite framework.
- Informal consulting such as participating on standing committees, limited-life projects, or ad hoc meetings offering risk insight.
- Special consulting such as participation in a merger, system implementation, or new product launch team to advise on risks.
- Emergency consulting such as helping management respond to a crisis, disaster, or sudden control failure.
Consulting engagements may also be blended with assurance; the Standards require that when both occur, the auditor applies the relevant assurance and consulting standards appropriately and keeps the client clear about which is which.
3. The IIA Position Paper: Roles Internal Audit Can, Should Not, and May Perform
The single most testable framework for this topic is the IIA Position Paper The Role of Internal Auditing in Enterprise-wide Risk Management, often depicted as a fan diagram. Learn its three zones precisely.
Core internal audit roles in ERM (assurance, no safeguards needed):
- Giving assurance on risk management processes.
- Giving assurance that risks are correctly evaluated.
- Evaluating risk management processes.
- Evaluating the reporting of key risks.
- Reviewing the management of key risks.
Legitimate internal audit roles with safeguards (consulting zone):
- Facilitating identification and evaluation of risks.
- Coaching management in responding to risks.
- Coordinating ERM activities.
- Consolidating the reporting on risks.
- Maintaining and developing the ERM framework.
- Championing the establishment of ERM.
- Developing a risk management strategy for board approval.
Roles internal audit should NOT undertake (management responsibilities):
- Setting the risk appetite.
- Imposing risk management processes.
- Providing management assurance on risks (i.e., acting as the first or second line).
- Taking decisions on risk responses.
- Implementing risk responses on management's behalf.
- Accountability for risk management.
The dividing line is simple: internal audit may advise, facilitate, challenge, and support, but it may never decide, own, implement, or be accountable.
4. The Required Safeguards
When internal audit performs any role in the consulting zone, the Position Paper and the Standards require specific safeguards:
- It must be clear that management remains responsible for risk management.
- The nature of internal audit's responsibilities should be documented in the internal audit charter and approved by the board (Standard 1000.C1).
- Internal audit should not manage any of the risks on behalf of management.
- Internal audit should provide advice, challenge, and support to management decision-making, as opposed to making risk management decisions itself.
- Internal audit cannot provide objective assurance on any part of the ERM framework for which it is responsible. If internal audit has assisted in design, assurance on that element should be obtained from other suitably qualified parties, or performed after a cooling-off period, typically at least one year.
- Any work beyond the assurance activities should be recognized as a consulting engagement and the consulting implementation standards must be followed.
These safeguards also align with the Three Lines Model (2020): management (first line) owns and manages risk, risk and compliance functions (second line) provide expertise and monitoring, and internal audit (third line) provides independent assurance and advice. Consulting lets internal audit support the first and second lines without becoming part of them.
5. How Consulting on Risk Management Works Under the Standards
The 2017 International Standards contain Consulting Implementation Standards (marked with a C) that govern every stage of a consulting engagement. The most frequently tested are:
Acceptance and planning
- 1000.C1: The nature of consulting services must be defined in the internal audit charter.
- 1130.C1: Internal auditors may provide consulting services relating to operations for which they previously had responsibilities (unlike assurance, where a one-year cooling-off period applies).
- 1130.C2: If internal auditors have potential impairments to independence or objectivity relating to a proposed consulting engagement, disclosure must be made to the engagement client before accepting the engagement.
- 1210.C1: The CAE must decline the engagement or obtain competent advice and assistance if internal auditors lack the knowledge, skills, or competencies needed.
- 1220.C1: Due professional care considers the needs and expectations of clients (including the nature, timing, and communication of results), the relative complexity and extent of work needed, and the cost of the engagement relative to potential benefits.
- 2010.C1: The CAE should consider accepting proposed consulting engagements based on their potential to improve risk management, add value, and improve the organization's operations. Accepted engagements must be included in the audit plan.
Performing the engagement
- 2120.C1: During consulting engagements, internal auditors must address risk consistent with the engagement's objectives and be alert to the existence of other significant risks.
- 2120.C2: Internal auditors must incorporate knowledge of risks gained from consulting engagements into their evaluation of the organization's risk management processes.
- 2120.C3: When assisting management in establishing or improving risk management processes, internal auditors must refrain from assuming any management responsibility by actually managing risks.
- 2201.C1: Internal auditors must establish an understanding with consulting engagement clients about objectives, scope, respective responsibilities, and other client expectations. For significant engagements, this understanding must be documented.
- 2210.C1: Objectives must address governance, risk management, and control processes to the extent agreed upon with the client, and must be consistent with the organization's values, strategies, and objectives.
- 2220.C1 and C2: Scope must be sufficient to address the agreed-upon objectives. If reservations about scope arise during the engagement, they must be discussed with the client to determine whether to continue.
- 2240.C1: Work programs may vary in form and content depending on the nature of the engagement.
- 2330.C1: The CAE must develop policies governing custody and retention of consulting engagement records and their release to internal and external parties.
Communicating and monitoring
- 2410.C1: Communication of progress and results may vary in form and content depending on the nature of the engagement and the client's needs.
- 2440.C1: The CAE is responsible for communicating final results of consulting engagements to clients.
- 2440.C2: During consulting engagements, governance, risk management, and control issues may be identified. Whenever these issues are significant to the organization, they must be communicated to senior management and the board, even if the client prefers otherwise.
- 2500.C1: The internal audit activity must monitor the disposition of results of consulting engagements to the extent agreed upon with the client.
6. A Typical Risk Management Consulting Engagement in Practice
Imagine management asks internal audit to help launch an ERM program. A compliant approach would look like this:
1. The CAE confirms the charter permits such consulting and considers whether the engagement adds value (2010.C1). The CAE checks staff competence (1210.C1) and discloses any objectivity concerns (1130.C2).
2. The CAE documents a written understanding with the client covering objectives, scope, responsibilities, and deliverables (2201.C1), making explicit that management owns the risk appetite, risk responses, and the resulting framework.
3. Internal audit facilitates risk identification workshops, provides templates and training, benchmarks against COSO ERM or ISO 31000, and advises on reporting design, while management makes every decision about which risks matter and how to respond.
4. If auditors notice a significant control weakness or fraud indicator during the workshops, they report it to senior management and the board (2440.C2, 2120.C1).
5. Results are communicated to management in a format agreed with the client, and the CAE informs the board of the engagement as part of periodic reporting.
6. Insights about the risk universe feed into audit planning (2120.C2), but internal audit arranges for an alternative provider or waits a suitable period before giving assurance on the framework it helped build.
7. How to Answer Exam Questions on This Topic
Most CRMA questions here are scenario-based. Use this decision approach:
Step 1 - Classify the activity. Ask whether the activity is assurance, legitimate consulting, or a management responsibility. If the scenario involves deciding, owning, implementing, or being accountable for risks, the correct answer is that internal audit should not perform it.
Step 2 - Identify the stage of the engagement. Questions about charters, acceptance, and disclosure point to the 1000 and 1130 series and 2010.C1. Questions about what to do with issues discovered point to 2120.C1 and 2440.C2. Questions about who receives reports point to 2440.C1 and the board communication requirement.
Step 3 - Apply the safeguard logic. The right answer almost always preserves independence and objectivity: disclose impairments beforehand, document the client's ownership, keep the board informed, and arrange alternative assurance for anything internal audit designed.
Step 4 - Watch for the word 'agreed.' Consulting scope, objectives, communication, and follow-up are all agreed with the client. If an answer choice says the internal auditor unilaterally determines the scope of a consulting engagement, it is describing assurance and is likely wrong.
Step 5 - Remember the asymmetry on prior responsibilities. An auditor who managed a function last year cannot provide assurance on it this year, but may provide consulting on it. Many candidates miss this distinction.
8. Exam Tips: Answering Questions on Advisory and Consulting Services on Risk Management
- Memorize the fan diagram in three columns. Expect at least one question asking which role is inappropriate for internal audit. The six 'should not' roles (setting risk appetite, imposing processes, management assurance, deciding responses, implementing responses, accountability) are prime distractors dressed up as helpful activities.
- Facilitating is fine; deciding is not. If the stem says internal audit 'facilitated' a workshop or 'coached' managers, that is acceptable with safeguards. If it says internal audit 'selected' the risk responses or 'approved' the appetite, it has crossed the line.
- Significant issues always go up. Even if a consulting client requests confidentiality, significant governance, risk, or control issues must reach senior management and the board. Choose the answer that escalates.
- Disclosure timing matters. Impairments on consulting engagements are disclosed before acceptance, to the client. Do not confuse this with assurance impairments, which are disclosed to appropriate parties and may require reassignment.
- Charter first. If a question asks about the foundation for providing consulting services, the answer is that the nature of consulting must be defined in the internal audit charter approved by the board.
- Decline or get help when skills are lacking. The CAE never proceeds with a consulting engagement the team is not competent to perform; the correct action is to decline or obtain competent advice and assistance.
- Knowledge flows back to assurance. If asked what to do with risk information learned during consulting, the answer is to incorporate it into the evaluation of risk management processes and audit planning, not to ignore it because it came from consulting.
- Cooling-off applies to assurance, not consulting. Expect a question testing whether an auditor can consult on an area they recently managed; the answer is yes, with disclosure of potential impairments.
- Look for 'management remains responsible' language. When several answers seem plausible, the one that explicitly preserves management's ownership and internal audit's advisory role is almost always correct.
- Eliminate absolutes carelessly stated. Answers claiming internal audit 'must never' perform any ERM-related activity are wrong, as are those saying it 'may perform any' activity requested by management. The IIA position is nuanced: core assurance roles, legitimate consulting roles with safeguards, and prohibited management roles.
- Think value and risk when choosing engagements. If asked how the CAE should decide which consulting requests to accept, the answer centers on the potential to improve risk management, add value, and improve operations, balanced against resource constraints and independence.
- Manage your time. Scenario questions in this area can be long. Read the final sentence of the stem first to know what is being asked, then scan the scenario for signals such as who decides, who owns, who is informed, and whether a charter or agreement exists.
9. Summary
Advisory and consulting services allow internal audit to contribute directly to stronger risk management while the organization retains full ownership of its risks. The exam expects you to know the definition and two-party nature of consulting, the fan diagram of permitted, conditional, and prohibited roles, the safeguards that protect independence, and the consulting implementation standards covering charter, acceptance, disclosure, competence, scope, communication, escalation of significant issues, and follow-up. Anchor every answer in one principle: internal audit advises, facilitates, and challenges, but management decides, implements, and remains accountable.
Internal audit is no longer confined to telling management what went wrong after the fact. Boards and executives increasingly expect the internal audit activity to help the organization build effective risk management, not merely to assess it. This creates a tension that sits at the heart of the CRMA syllabus: how can internal audit help design, facilitate, and improve risk management processes while remaining independent and objective enough to provide assurance on those same processes later?
The CRMA exam tests this topic heavily because it is where theory meets judgment. Candidates must understand the difference between assurance and consulting, know which roles internal audit may legitimately perform in enterprise risk management (ERM), recognize the roles it must never perform, and apply the safeguards the IIA requires. Questions in this area are rarely about memorizing definitions; they present scenarios and ask what the chief audit executive (CAE) or internal auditor should do. Mastering this topic therefore improves your performance on a large share of situational questions across the entire exam.
2. What Advisory and Consulting Services on Risk Management Are
The IIA defines consulting services as advisory and related client service activities, the nature and scope of which are agreed with the client, intended to add value and improve an organization's governance, risk management, and control processes without the internal auditor assuming management responsibility. Examples include counsel, advice, facilitation, and training. In the 2024 Global Internal Audit Standards the term advisory services is used, but the concept is identical.
Contrast this with assurance services: an objective examination of evidence to provide an independent assessment on governance, risk management, and control processes. Three key differences you must know:
- Parties involved: Assurance has three parties (process owner, internal auditor, user). Consulting has two parties (the internal auditor and the engagement client).
- Who decides scope: In assurance, the internal auditor determines nature and scope. In consulting, nature and scope are agreed with the client.
- Nature of the output: Assurance produces an independent opinion or conclusion. Consulting produces advice and recommendations that management is free to accept or reject.
Common forms of risk-related consulting include:
- Formal consulting engagements that are planned and documented, such as helping design a risk register or risk appetite framework.
- Informal consulting such as participating on standing committees, limited-life projects, or ad hoc meetings offering risk insight.
- Special consulting such as participation in a merger, system implementation, or new product launch team to advise on risks.
- Emergency consulting such as helping management respond to a crisis, disaster, or sudden control failure.
Consulting engagements may also be blended with assurance; the Standards require that when both occur, the auditor applies the relevant assurance and consulting standards appropriately and keeps the client clear about which is which.
3. The IIA Position Paper: Roles Internal Audit Can, Should Not, and May Perform
The single most testable framework for this topic is the IIA Position Paper The Role of Internal Auditing in Enterprise-wide Risk Management, often depicted as a fan diagram. Learn its three zones precisely.
Core internal audit roles in ERM (assurance, no safeguards needed):
- Giving assurance on risk management processes.
- Giving assurance that risks are correctly evaluated.
- Evaluating risk management processes.
- Evaluating the reporting of key risks.
- Reviewing the management of key risks.
Legitimate internal audit roles with safeguards (consulting zone):
- Facilitating identification and evaluation of risks.
- Coaching management in responding to risks.
- Coordinating ERM activities.
- Consolidating the reporting on risks.
- Maintaining and developing the ERM framework.
- Championing the establishment of ERM.
- Developing a risk management strategy for board approval.
Roles internal audit should NOT undertake (management responsibilities):
- Setting the risk appetite.
- Imposing risk management processes.
- Providing management assurance on risks (i.e., acting as the first or second line).
- Taking decisions on risk responses.
- Implementing risk responses on management's behalf.
- Accountability for risk management.
The dividing line is simple: internal audit may advise, facilitate, challenge, and support, but it may never decide, own, implement, or be accountable.
4. The Required Safeguards
When internal audit performs any role in the consulting zone, the Position Paper and the Standards require specific safeguards:
- It must be clear that management remains responsible for risk management.
- The nature of internal audit's responsibilities should be documented in the internal audit charter and approved by the board (Standard 1000.C1).
- Internal audit should not manage any of the risks on behalf of management.
- Internal audit should provide advice, challenge, and support to management decision-making, as opposed to making risk management decisions itself.
- Internal audit cannot provide objective assurance on any part of the ERM framework for which it is responsible. If internal audit has assisted in design, assurance on that element should be obtained from other suitably qualified parties, or performed after a cooling-off period, typically at least one year.
- Any work beyond the assurance activities should be recognized as a consulting engagement and the consulting implementation standards must be followed.
These safeguards also align with the Three Lines Model (2020): management (first line) owns and manages risk, risk and compliance functions (second line) provide expertise and monitoring, and internal audit (third line) provides independent assurance and advice. Consulting lets internal audit support the first and second lines without becoming part of them.
5. How Consulting on Risk Management Works Under the Standards
The 2017 International Standards contain Consulting Implementation Standards (marked with a C) that govern every stage of a consulting engagement. The most frequently tested are:
Acceptance and planning
- 1000.C1: The nature of consulting services must be defined in the internal audit charter.
- 1130.C1: Internal auditors may provide consulting services relating to operations for which they previously had responsibilities (unlike assurance, where a one-year cooling-off period applies).
- 1130.C2: If internal auditors have potential impairments to independence or objectivity relating to a proposed consulting engagement, disclosure must be made to the engagement client before accepting the engagement.
- 1210.C1: The CAE must decline the engagement or obtain competent advice and assistance if internal auditors lack the knowledge, skills, or competencies needed.
- 1220.C1: Due professional care considers the needs and expectations of clients (including the nature, timing, and communication of results), the relative complexity and extent of work needed, and the cost of the engagement relative to potential benefits.
- 2010.C1: The CAE should consider accepting proposed consulting engagements based on their potential to improve risk management, add value, and improve the organization's operations. Accepted engagements must be included in the audit plan.
Performing the engagement
- 2120.C1: During consulting engagements, internal auditors must address risk consistent with the engagement's objectives and be alert to the existence of other significant risks.
- 2120.C2: Internal auditors must incorporate knowledge of risks gained from consulting engagements into their evaluation of the organization's risk management processes.
- 2120.C3: When assisting management in establishing or improving risk management processes, internal auditors must refrain from assuming any management responsibility by actually managing risks.
- 2201.C1: Internal auditors must establish an understanding with consulting engagement clients about objectives, scope, respective responsibilities, and other client expectations. For significant engagements, this understanding must be documented.
- 2210.C1: Objectives must address governance, risk management, and control processes to the extent agreed upon with the client, and must be consistent with the organization's values, strategies, and objectives.
- 2220.C1 and C2: Scope must be sufficient to address the agreed-upon objectives. If reservations about scope arise during the engagement, they must be discussed with the client to determine whether to continue.
- 2240.C1: Work programs may vary in form and content depending on the nature of the engagement.
- 2330.C1: The CAE must develop policies governing custody and retention of consulting engagement records and their release to internal and external parties.
Communicating and monitoring
- 2410.C1: Communication of progress and results may vary in form and content depending on the nature of the engagement and the client's needs.
- 2440.C1: The CAE is responsible for communicating final results of consulting engagements to clients.
- 2440.C2: During consulting engagements, governance, risk management, and control issues may be identified. Whenever these issues are significant to the organization, they must be communicated to senior management and the board, even if the client prefers otherwise.
- 2500.C1: The internal audit activity must monitor the disposition of results of consulting engagements to the extent agreed upon with the client.
6. A Typical Risk Management Consulting Engagement in Practice
Imagine management asks internal audit to help launch an ERM program. A compliant approach would look like this:
1. The CAE confirms the charter permits such consulting and considers whether the engagement adds value (2010.C1). The CAE checks staff competence (1210.C1) and discloses any objectivity concerns (1130.C2).
2. The CAE documents a written understanding with the client covering objectives, scope, responsibilities, and deliverables (2201.C1), making explicit that management owns the risk appetite, risk responses, and the resulting framework.
3. Internal audit facilitates risk identification workshops, provides templates and training, benchmarks against COSO ERM or ISO 31000, and advises on reporting design, while management makes every decision about which risks matter and how to respond.
4. If auditors notice a significant control weakness or fraud indicator during the workshops, they report it to senior management and the board (2440.C2, 2120.C1).
5. Results are communicated to management in a format agreed with the client, and the CAE informs the board of the engagement as part of periodic reporting.
6. Insights about the risk universe feed into audit planning (2120.C2), but internal audit arranges for an alternative provider or waits a suitable period before giving assurance on the framework it helped build.
7. How to Answer Exam Questions on This Topic
Most CRMA questions here are scenario-based. Use this decision approach:
Step 1 - Classify the activity. Ask whether the activity is assurance, legitimate consulting, or a management responsibility. If the scenario involves deciding, owning, implementing, or being accountable for risks, the correct answer is that internal audit should not perform it.
Step 2 - Identify the stage of the engagement. Questions about charters, acceptance, and disclosure point to the 1000 and 1130 series and 2010.C1. Questions about what to do with issues discovered point to 2120.C1 and 2440.C2. Questions about who receives reports point to 2440.C1 and the board communication requirement.
Step 3 - Apply the safeguard logic. The right answer almost always preserves independence and objectivity: disclose impairments beforehand, document the client's ownership, keep the board informed, and arrange alternative assurance for anything internal audit designed.
Step 4 - Watch for the word 'agreed.' Consulting scope, objectives, communication, and follow-up are all agreed with the client. If an answer choice says the internal auditor unilaterally determines the scope of a consulting engagement, it is describing assurance and is likely wrong.
Step 5 - Remember the asymmetry on prior responsibilities. An auditor who managed a function last year cannot provide assurance on it this year, but may provide consulting on it. Many candidates miss this distinction.
8. Exam Tips: Answering Questions on Advisory and Consulting Services on Risk Management
- Memorize the fan diagram in three columns. Expect at least one question asking which role is inappropriate for internal audit. The six 'should not' roles (setting risk appetite, imposing processes, management assurance, deciding responses, implementing responses, accountability) are prime distractors dressed up as helpful activities.
- Facilitating is fine; deciding is not. If the stem says internal audit 'facilitated' a workshop or 'coached' managers, that is acceptable with safeguards. If it says internal audit 'selected' the risk responses or 'approved' the appetite, it has crossed the line.
- Significant issues always go up. Even if a consulting client requests confidentiality, significant governance, risk, or control issues must reach senior management and the board. Choose the answer that escalates.
- Disclosure timing matters. Impairments on consulting engagements are disclosed before acceptance, to the client. Do not confuse this with assurance impairments, which are disclosed to appropriate parties and may require reassignment.
- Charter first. If a question asks about the foundation for providing consulting services, the answer is that the nature of consulting must be defined in the internal audit charter approved by the board.
- Decline or get help when skills are lacking. The CAE never proceeds with a consulting engagement the team is not competent to perform; the correct action is to decline or obtain competent advice and assistance.
- Knowledge flows back to assurance. If asked what to do with risk information learned during consulting, the answer is to incorporate it into the evaluation of risk management processes and audit planning, not to ignore it because it came from consulting.
- Cooling-off applies to assurance, not consulting. Expect a question testing whether an auditor can consult on an area they recently managed; the answer is yes, with disclosure of potential impairments.
- Look for 'management remains responsible' language. When several answers seem plausible, the one that explicitly preserves management's ownership and internal audit's advisory role is almost always correct.
- Eliminate absolutes carelessly stated. Answers claiming internal audit 'must never' perform any ERM-related activity are wrong, as are those saying it 'may perform any' activity requested by management. The IIA position is nuanced: core assurance roles, legitimate consulting roles with safeguards, and prohibited management roles.
- Think value and risk when choosing engagements. If asked how the CAE should decide which consulting requests to accept, the answer centers on the potential to improve risk management, add value, and improve operations, balanced against resource constraints and independence.
- Manage your time. Scenario questions in this area can be long. Read the final sentence of the stem first to know what is being asked, then scan the scenario for signals such as who decides, who owns, who is informed, and whether a charter or agreement exists.
9. Summary
Advisory and consulting services allow internal audit to contribute directly to stronger risk management while the organization retains full ownership of its risks. The exam expects you to know the definition and two-party nature of consulting, the fan diagram of permitted, conditional, and prohibited roles, the safeguards that protect independence, and the consulting implementation standards covering charter, acceptance, disclosure, competence, scope, communication, escalation of significant issues, and follow-up. Anchor every answer in one principle: internal audit advises, facilitates, and challenges, but management decides, implements, and remains accountable.
Test mode:
CRMA - Advisory and Consulting Services on Risk Management Example Questions
Test your knowledge of Advisory and Consulting Services on Risk Management
Question 1
Last year, the internal audit function carried out an advisory engagement. Two internal auditors facilitated workshops and helped management design a new enterprise risk management process. Management approved the process, owns it, and now operates it. The audit committee has asked for independent assurance on whether the process is working effectively. What is the MOST appropriate response by the chief audit executive?
Question 2
Senior management asks the internal audit function to help launch an organizationwide risk management process. The proposed terms are as follows. Internal audit leads workshops with business unit managers. It consolidates the workshop output into a single risk report for the board. It defines the thresholds used to score risks against appetite. The audit committee approves this role in the audit charter. Business unit managers will own the risks identified. Which proposed term should the chief audit executive challenge as the greatest threat to independence?
Question 3
Which of the following advisory roles may the internal audit function appropriately undertake in enterprise risk management, provided management retains ownership of risks and the board approves the arrangement?
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3053 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Advisory and Consulting Services on Risk Management questions
17 questions (total)
Other Internal Audit Roles and Responsibilities concepts
Advocating for Enterprise Risk ManagementAssessing Internal Audit Skill GapsAssurance Services on Risk ManagementBuilding an Organizationwide Risk Assurance MapChief Audit Executive Roles Beyond Internal AuditingChoosing Assurance or Advisory for a Risk RequestCombined AssuranceCompetencies for Risk Management AssuranceCoordinating Assurance Across ProvidersCore Internal Audit Roles in Enterprise Risk ManagementCo-Sourcing and Outsourcing Risk ExpertiseDeclining or Adjusting Work That Lacks CompetenceDeveloping Risk Management Competence in StaffEvaluating Reliance on Other Assurance ProvidersFinding Gaps and Overlaps with an Assurance MapFunctional and Administrative Reporting LinesImpairments from Risk Management ResponsibilitiesImproving Existing Risk Management ProcessesInternal Audit ERM Roles That Need SafeguardsInternal Audit's Role When No Risk Process ExistsMaintaining and Updating the Assurance MapOrganizational Independence of Internal AuditRecommending an Organizationwide Risk StrategyRelying on External Auditors and RegulatorsReporting Impairments to the Board and ManagementRoles Internal Audit Should Not Take in ERMSafeguards When Internal Audit Leads Risk WorkThe Three Lines ModelUsing External Experts in Risk Engagements