Advocating for Enterprise Risk Management

1. Why This Topic Matters

Enterprise Risk Management (ERM) is the organization-wide process of identifying, assessing, responding to, and monitoring risks so that objectives can be achieved. Many organizations, however, do not have a formal ERM framework, or have one that is immature, fragmented, or purely compliance-driven. In these situations, internal audit is frequently the function with the deepest understanding of risk and the broadest view of the organization. The IIA therefore recognizes that internal auditors can legitimately champion or advocate for the establishment and improvement of ERM.

This topic is important for the CRMA exam for three reasons:
- It sits within Domain I: Internal Audit Roles and Responsibilities, which tests whether you understand where internal audit's role in risk management begins and ends.
- It directly tests your understanding of independence and objectivity: advocating for ERM is permitted, but only with safeguards, and only up to the point where internal audit would start to own or manage risk.
- It links to the Three Lines Model, the Global Internal Audit Standards (and the legacy Standard 2120 Risk Management), and the IIA Position Paper The Role of Internal Auditing in Enterprise-wide Risk Management, all of which are core CRMA reference material.

In practice, an internal audit function that advocates effectively for ERM adds significant value: it helps the board discharge its risk oversight duties, strengthens the second line, improves the quality of risk information used in decisions, and ultimately improves the risk environment in which internal audit itself provides assurance.

2. What Advocating for ERM Means

Advocating for ERM means that internal audit actively promotes, educates, encourages, and supports the organization in establishing or maturing a structured, enterprise-wide approach to risk management. It is a consulting (advisory) role, not an assurance role, and it is not a management role.

The IIA Position Paper uses a fan diagram that divides internal audit's possible ERM roles into three zones:

(a) Core internal audit roles in ERM (assurance):
- Giving assurance on risk management processes.
- Giving assurance that risks are correctly evaluated.
- Evaluating risk management processes.
- Evaluating the reporting of key risks.
- Reviewing the management of key risks.

(b) Legitimate internal audit roles with safeguards (consulting):
- Facilitating identification and evaluation of risks.
- Coaching management in responding to risks.
- Coordinating ERM activities.
- Consolidating the reporting on risks.
- Maintaining and developing the ERM framework.
- Championing the establishment of ERM.
- Developing risk management strategy for board approval.

(c) Roles internal audit should NOT undertake:
- Setting the risk appetite.
- Imposing risk management processes.
- Providing management assurance on risks.
- Making decisions on risk responses.
- Implementing risk responses on management's behalf.
- Being accountable for risk management.

Advocating for ERM falls squarely into zone (b). The exam expects you to recognize that it is legitimate, that it requires safeguards, and that it must never drift into zone (c).

3. The Framework and Standards Behind the Role

Three Lines Model (IIA, 2020): Management (first and second line roles) owns and manages risk; the governing body sets direction and oversees; internal audit (third line) provides independent assurance and advice. The model explicitly allows internal audit to provide advice and insight, which is the basis for advocacy, provided independence is protected.

Global Internal Audit Standards (2024): The chief audit executive must understand the organization's governance, risk management, and control processes (Standard 9.1) and may provide advisory services that promote improvement, as long as the internal audit charter permits it and independence is not impaired. Where the function has performed design or advisory work, the Standards require that objectivity be safeguarded and that assurance on that same area be managed carefully (for example, by another party or after a cooling-off period).

Legacy Standard 2120 Risk Management (IPPF): Internal audit must evaluate the effectiveness and contribute to the improvement of risk management processes. Its Interpretation states that internal auditors may assist management in establishing or improving risk management processes but must refrain from assuming any management responsibility by actually managing risks. This single sentence is the heart of the advocacy topic and is heavily tested.

Risk frameworks internal audit may promote: COSO ERM: Integrating with Strategy and Performance (2017) and ISO 31000:2018. Internal audit may recommend a framework and explain its benefits, but management and the board choose and adopt it.

4. How Advocacy Works in Practice

Step 1: Assess risk management maturity. Internal audit first evaluates how mature ERM is, often using a maturity scale such as risk naive, risk aware, risk defined, risk managed, and risk enabled. The lower the maturity, the greater the legitimate scope for internal audit to advocate and facilitate; the higher the maturity, the more internal audit should concentrate on assurance.

Step 2: Build the business case. Effective advocacy frames ERM in terms the board and executives value: better strategic decisions, protection of value, regulatory and listing expectations, lower cost of surprises, improved capital allocation, and stronger stakeholder confidence. Internal audit can draw on its own engagement results to show that recurring findings share a root cause: the absence of a structured risk process.

Step 3: Educate and influence. Internal audit educates the audit committee, board, and senior management on risk concepts, risk appetite, and framework options; it benchmarks against peers and regulators' expectations; it may run pilot risk workshops to demonstrate the value of structured risk identification and assessment.

Step 4: Recommend ownership in the first and second lines. A key feature of good advocacy is recommending that management appoint a risk owner, such as a chief risk officer or a risk management function (second line), and that the board or a board committee take oversight responsibility. Internal audit is the catalyst, not the permanent home for ERM.

Step 5: Apply safeguards. The IIA Position Paper lists safeguards that must be in place whenever internal audit takes on roles in zone (b):
- It should be clear that management remains responsible for risk management.
- The nature of internal audit's responsibilities should be documented in the internal audit charter and approved by the audit committee.
- Internal audit should not manage any of the risks on behalf of management.
- Internal audit should provide advice, challenge, and support to management's decision making, as opposed to taking risk management decisions itself.
- Internal audit cannot give objective assurance on any part of the ERM framework for which it is responsible; such assurance should be provided by other suitably qualified parties.
- Any work beyond assurance activities should be recognized as a consulting engagement, and the implementation standards relating to consulting should be followed.

Step 6: Plan the exit. Advocacy should be time-bound. As ERM matures and a second-line function takes ownership, internal audit withdraws from facilitation and coordination roles and returns to its core assurance role, evaluating the ERM processes that management now owns.

5. Key Distinctions the Exam Tests

Advocating versus owning: Recommending that the organization adopt COSO ERM is advocacy. Writing the risk management policy and issuing it under internal audit's authority is ownership and impairs independence.

Facilitating versus deciding: Running a workshop where managers identify and rate their own risks is facilitation. Deciding the final risk ratings or selecting responses is management's job.

Recommending risk appetite discussions versus setting risk appetite: Internal audit can urge the board to articulate a risk appetite and can explain what a good statement looks like, but setting the appetite belongs to the board and senior management.

Temporary versus permanent: Internal audit may temporarily coordinate ERM where no one else can, with charter approval and audit committee awareness, but a permanent arrangement signals that the organization has outsourced management responsibility to the third line.

Assurance after advocacy: If internal audit helped design the ERM framework, it should not be the party giving assurance on that design, at least until sufficient time has passed and objectivity can be demonstrated. The audit committee should arrange alternative assurance (for example, an external review).

6. Exam Tips: Answering Questions on Advocating for Enterprise Risk Management

Tip 1: Classify the activity into one of the three zones first. Ask: Is this assurance (core), advisory with safeguards (legitimate), or management (prohibited)? Most questions resolve themselves once you place the activity correctly. 'Championing the establishment of ERM' is always in the legitimate-with-safeguards zone.

Tip 2: Watch the verbs. Words such as recommend, advise, educate, facilitate, promote, champion, coach, support indicate acceptable advocacy. Words such as decide, approve, set, own, implement, impose, be accountable for indicate management responsibility and are red flags. If the stem says internal audit 'sets the risk appetite' or 'implements risk responses', that answer is wrong (or is the correct answer to a 'which is inappropriate' question).

Tip 3: The most independent-preserving answer is usually correct. When two options both seem helpful, choose the one that keeps management responsible for risk, keeps internal audit in an advisory posture, and involves the audit committee or board.

Tip 4: Remember the safeguards list. Questions frequently ask 'which safeguard is required if internal audit facilitates or champions ERM?' Expect answers such as documenting the role in the charter, ensuring management retains responsibility, treating the work as a consulting engagement, and arranging alternative assurance for areas internal audit helped design.

Tip 5: Link maturity to the appropriate role. If the scenario describes an organization with no formal ERM (risk naive or risk aware), a facilitative, advocating role is appropriate. If the organization has a mature, embedded ERM with a chief risk officer, the correct internal audit role shifts to evaluating and providing assurance, and continued coordination by internal audit would be inappropriate.

Tip 6: Distinguish the second line from the third line. If a question asks who should ultimately own the ERM framework that internal audit has championed, the answer is management, typically through a second-line risk function, with oversight by the board. Internal audit is never the long-term owner.

Tip 7: Know the Standards language. Be able to recognize that internal auditors 'may assist management in establishing or improving risk management processes' but must 'refrain from assuming any management responsibility by actually managing risks'. Questions often paraphrase this interpretation.

Tip 8: For scenario questions, identify the stakeholder. Advocacy is directed at the board, audit committee, and senior management. An answer suggesting internal audit should directly instruct operational staff to adopt risk procedures is imposing processes, which is prohibited.

Tip 9: Consider the 'what should the CAE do first?' pattern. Common correct first steps include assessing current risk maturity, discussing the proposed role with the audit committee, and ensuring the charter permits the consulting role. Jumping straight into designing the framework is usually the distractor.

Tip 10: Eliminate absolutes. Options stating internal audit 'must never' be involved in ERM development, or that it 'should always' lead ERM, are both wrong. The IIA position is balanced: internal audit can legitimately champion and facilitate ERM, provided safeguards protect its independence and objectivity.

7. Summary

Advocating for ERM is a recognized, value-adding consulting role for internal audit, particularly in organizations with immature risk management. Internal audit can champion ERM, educate the board and management, facilitate risk identification, recommend frameworks such as COSO ERM or ISO 31000, and support the creation of a second-line risk function. It must do so without setting risk appetite, making risk decisions, implementing responses, or taking accountability for risk management, and it must apply the IIA safeguards: documented charter authority, clear management ownership, consulting engagement treatment, and alternative assurance for areas it helped design. For the CRMA exam, success comes from classifying each activity into the correct zone of the fan diagram, scrutinizing the verbs used, and always choosing the option that preserves internal audit's independence while helping the organization mature its risk management.