Assurance Services on Risk Management

1. Why Assurance Services on Risk Management Matter

Risk management is the engine that keeps an organization moving toward its objectives while avoiding catastrophic surprises. Yet the board and senior management cannot simply take it on faith that the risk management process actually works. They need an independent, objective voice to confirm that key risks are identified, properly evaluated, appropriately responded to, and accurately reported. That voice is internal audit, and the service it provides is assurance on risk management.

For the CRMA (Certification in Risk Management Assurance) candidate, this topic sits at the heart of the exam. The CRMA exists specifically because the IIA recognized that providing assurance over risk management is a distinct and increasingly demanded competency. If you misunderstand the line between what internal audit should do, may do with safeguards, and must never do in relation to risk management, you will struggle with a large share of exam questions. Equally important in practice: an internal audit function that drifts into owning or managing risk destroys its own independence, which in turn destroys the value of every assurance report it issues.

Key reasons this topic is important:
- Boards and audit committees rely on internal audit as their primary independent source of assurance on risk management (the third line in the IIA Three Lines Model).
- Regulators and stakeholders increasingly expect formal statements or opinions on the adequacy of risk management.
- The Global Internal Audit Standards require internal audit to assess and contribute to the improvement of the organization's governance, risk management, and control processes.
- Independence and objectivity, the foundation of internal audit credibility, are most at risk precisely when auditors engage with risk management activities.

2. What Assurance Services on Risk Management Are

Definition of assurance. Assurance services are objective examinations of evidence for the purpose of providing an independent assessment on governance, risk management, and control processes. In an assurance engagement there are typically three parties: the process owner (management, who owns the risk management process), the internal auditor (who performs the assessment), and the user (the board, audit committee, or senior management who relies on the result). Contrast this with consulting services, which are advisory in nature, involve two parties, and whose scope is agreed with the client.

The IIA position on internal audit's role in ERM. The IIA Position Paper on the Role of Internal Auditing in Enterprise-wide Risk Management introduced the well-known fan diagram, which the CRMA exam draws on heavily. It divides possible activities into three zones:

Zone 1: Core internal audit roles in regard to ERM (assurance). These are activities internal audit should perform because they are the essence of independent assurance:
- Giving assurance on the risk management processes.
- Giving assurance that risks are correctly evaluated.
- Evaluating risk management processes.
- Evaluating the reporting of key risks.
- Reviewing the management of key risks.

Zone 2: Legitimate internal audit roles with safeguards (consulting). Internal audit may undertake these if appropriate safeguards protect independence:
- Facilitating identification and evaluation of risks.
- Coaching management in responding to risks.
- Coordinating ERM activities.
- Consolidating the reporting on risks.
- Maintaining and developing the ERM framework.
- Championing establishment of ERM.
- Developing risk management strategy for board approval.

Zone 3: Roles internal audit should NOT undertake. These are management responsibilities and would impair independence:
- Setting the risk appetite.
- Imposing risk management processes.
- Management assurance on risks (i.e., acting as the source of first-line or second-line assurance).
- Taking decisions on risk responses.
- Implementing risk responses on management's behalf.
- Accountability for risk management.

Memory aid: If the activity involves evaluating, reviewing, or giving assurance, it is core. If it involves facilitating, coaching, coordinating, consolidating, maintaining, championing, or developing for approval, it is permitted with safeguards. If it involves setting, imposing, deciding, implementing, or being accountable, it is forbidden.

Safeguards for Zone 2 activities include:
- Management remains clearly responsible for risk management; internal audit does not manage any risks.
- The nature of internal audit's responsibilities is documented in the internal audit charter and approved by the board.
- Internal audit provides advice, challenge, and support to management decisions but does not make the decisions.
- Internal audit does not provide objective assurance on any part of the ERM framework for which it is responsible; such assurance comes from other qualified parties.
- Any work beyond assurance is recognized as consulting and the consulting standards are applied.
- A cooling-off period (generally at least one year) applies before an auditor provides assurance over an area for which they previously had responsibility.

Relationship to the Standards. Under the Global Internal Audit Standards, internal audit must assess the organization's risk management processes and contribute to their improvement. In assessing effectiveness, the internal auditor considers whether: organizational objectives support and align with mission and strategy; significant risks are identified and assessed; appropriate risk responses are selected that align risks with the organization's risk appetite; and relevant risk information is captured and communicated in a timely manner across the organization. The internal audit function must also evaluate the potential for fraud and how the organization manages fraud risk. Where no formal risk management process exists, the chief audit executive must bring this to the attention of management and the board, and internal audit may assist management in establishing one, but must not take ownership.

The Three Lines Model. Management (first line) owns and manages risk; risk, compliance, and similar functions (second line) provide expertise, monitoring, and challenge; internal audit (third line) provides independent and objective assurance and advice to the governing body on the adequacy and effectiveness of governance and risk management, including the work of the first and second lines. The CRMA exam expects you to recognize that internal audit assures over the second line, it does not replace it.

3. How Assurance on Risk Management Works

Step 1: Understand the risk management framework and maturity. The auditor first identifies the framework the organization uses (for example, COSO ERM: Integrating with Strategy and Performance, or ISO 31000) and assesses how mature the process is. Maturity ranges from risk naive (no formal approach), through risk aware and risk defined, to risk managed and risk enabled (fully embedded). The maturity level determines the audit approach: in a mature organization, internal audit can rely on and test management's risk assessment; in an immature one, internal audit must perform its own risk assessment for planning purposes and may recommend that management establish a process.

Step 2: Establish criteria. Assurance requires suitable criteria against which to evaluate. These may be the organization's own risk policy and risk appetite statement, a recognized framework, regulatory requirements, or leading practice. The criteria must be agreed with management and clearly communicated in the report.

Step 3: Define the engagement objectives and scope. Objectives typically address one or more of the core roles: is the risk management process designed appropriately; is it operating effectively; are risks (including emerging and strategic risks) correctly identified and evaluated; are risk responses appropriate and within appetite; is risk reporting to the board accurate, complete, and timely; and are key risks actually being managed as management claims.

Step 4: Gather and evaluate evidence. Techniques include reviewing risk registers and risk appetite statements, interviewing risk owners and the risk function, testing the completeness of risk identification by comparing registers to strategy documents and external risk sources, re-performing risk evaluations on a sample basis, tracing key risk indicators to source data, examining board and risk committee minutes, and assessing control effectiveness over key risks. The auditor focuses on whether the process would surface a significant risk if one existed, not merely whether the paperwork exists.

Step 5: Form conclusions and communicate. Results are communicated to management and the board with a clear conclusion against the criteria. The chief audit executive may also be asked to provide an overall opinion on risk management, which must be supported by sufficient, reliable, relevant, and useful information from the aggregate of engagements and other assurance providers. Significant gaps, such as risks outside appetite without a response, or risk reporting that understates exposure, must be escalated. If management accepts a level of risk the chief audit executive believes is unacceptable to the organization, the matter must be discussed with senior management and, if unresolved, communicated to the board.

Step 6: Follow up. Internal audit monitors the implementation of agreed actions to improve risk management and reports on their status.

Coordination with other assurance providers. Internal audit should map all sources of assurance (assurance mapping) to avoid duplication and gaps, and may place reliance on the work of the second line or external providers after assessing their competence, objectivity, and the quality of their work. Reliance does not transfer responsibility; the chief audit executive remains responsible for the conclusions reached.

4. How to Answer Exam Questions on Assurance Services on Risk Management

CRMA questions in this area tend to be scenario based. They describe a situation and ask what internal audit should do, which role is appropriate, or what threatens independence. Use the following approach:

Identify who owns the risk. In every scenario, management owns risk and risk management. Any answer that makes internal audit the owner, decision maker, or implementer is wrong, no matter how helpful it sounds.

Classify the activity into a zone. Ask yourself: is this evaluating or giving assurance (core), facilitating or advising (permitted with safeguards), or deciding and doing (prohibited)? The correct answer almost always follows from this classification.

Look for the safeguard. If the question asks how internal audit can perform a consulting role in ERM, the right answer involves documenting the role in the charter, ensuring management retains responsibility, obtaining board approval, and not providing assurance over work it performed.

Apply the Standards logic. When risk management does not exist or is immature, the answer is to inform management and the board, offer to assist, and base the audit plan on internal audit's own risk assessment. When management accepts excessive risk, the answer is to discuss with senior management and escalate to the board if unresolved.

Distinguish assurance from consulting. Assurance has three parties and an independent opinion; consulting has two parties and an agreed scope. If internal audit facilitates a risk workshop, that is consulting, and it cannot later provide independent assurance on that same assessment without a safeguard.

5. Exam Tips: Answering Questions on Assurance Services on Risk Management

Tip 1: Memorize the fan diagram. Know the five core roles, the seven roles with safeguards, and the six prohibited roles. Many questions simply test whether you can place an activity in the right zone.

Tip 2: Watch for verbs. Words such as evaluate, assess, review, assure signal core assurance. Facilitate, coach, coordinate, consolidate, champion, maintain, develop for approval signal consulting with safeguards. Set, impose, decide, implement, be accountable for signal prohibited management roles.

Tip 3: The most independent answer is usually right. When two options seem plausible, choose the one that preserves internal audit objectivity and leaves decisions and ownership with management.

Tip 4: Risk appetite belongs to the board and management. Internal audit assesses whether responses align with appetite; it never sets appetite. Any option in which internal audit determines appetite or tolerances is wrong.

Tip 5: Know the four assessment criteria from the Standards. Objectives align with mission; significant risks identified and assessed; responses align with appetite; risk information captured and communicated. Questions on how to evaluate effectiveness are built from these.

Tip 6: Remember the escalation path. Chief audit executive to senior management first, then to the board if the matter remains unresolved. Skipping management or going straight to regulators is not the IIA answer.

Tip 7: Maturity drives approach. Immature risk management means internal audit does more of its own risk assessment and may help build the process; mature risk management means internal audit tests and relies on management's process. Questions often hinge on recognizing which situation is described.

Tip 8: Reliance has conditions. Internal audit may rely on second-line or external assurance only after evaluating competence, objectivity, and due professional care, and the chief audit executive still owns the conclusion.

Tip 9: Cooling off is one year. Auditors who previously performed or managed an activity should not provide assurance over it for at least a year; the chief audit executive, if responsible for a non-audit function, must arrange for assurance over that function from outside internal audit.

Tip 10: Read the whole scenario before the options. Distractor answers are often technically correct activities placed in the wrong context, such as a legitimate consulting activity offered as the answer to a question that asks for an assurance activity. Anchor on exactly what the question asks: what should internal audit do, what impairs independence, what is the best response, or what is not appropriate.

6. Summary

Assurance on risk management is internal audit's contribution to the board's confidence that risks are being managed within appetite. Internal audit evaluates and reports; management owns and acts. The CRMA exam tests this boundary relentlessly. Master the three zones of the IIA position paper, the Standards' criteria for assessing risk management effectiveness, the safeguards that make consulting roles acceptable, and the escalation and reliance rules, and you will be well prepared to answer any question on assurance services on risk management with confidence.