Choosing Assurance or Advisory for a Risk Request

1. Why This Topic Matters

Every internal audit function regularly receives requests that touch on risk: Can you help us build a risk register? Can you tell the audit committee whether our risk assessment is reliable? Can you sit on the risk committee? Can you decide which of these risks we should accept? How the chief audit executive (CAE) classifies and responds to each request determines whether internal audit protects its independence and objectivity, whether it adds the value stakeholders actually need, and whether it stays within the boundaries set by the IIA's Global Internal Audit Standards and the Three Lines Model.

For the CRMA exam this is a core competency. The CRMA tests your ability to position internal audit correctly in relation to enterprise risk management (ERM): knowing which roles are core assurance roles, which are legitimate advisory roles that require safeguards, and which roles internal audit must never take on. Getting the classification wrong in practice can lead to internal audit auditing its own work, management shifting accountability onto the auditors, and the board losing its independent source of assurance on risk. Getting it wrong on the exam costs you points on one of the most heavily tested areas of the syllabus.

2. What the Concept Is

The IIA recognizes two broad categories of internal audit services:

Assurance services are an objective examination of evidence for the purpose of providing an independent assessment on governance, risk management, and control processes. Assurance engagements involve three parties: (1) the person or group directly involved with the process, system, or subject matter (the process owner or auditee), (2) the internal auditor making the assessment, and (3) the person or group using the assessment (the user, typically senior management and the board). The nature and scope are determined by the internal auditor. The output is a conclusion, opinion, or rating.

Advisory (consulting) services are advisory and related client service activities, the nature and scope of which are agreed with the client, intended to add value and improve an organization's governance, risk management, and control processes without the internal auditor assuming management responsibility. Advisory engagements involve two parties: (1) the internal auditor offering the advice and (2) the client receiving it. The output is typically recommendations, facilitation, training, or analysis rather than an independent opinion.

Choosing between assurance and advisory for a risk request is therefore the judgement the CAE makes when a risk-related request arrives: Is the organization asking internal audit to independently evaluate something (assurance), to help improve or build something (advisory), or to own or decide something (a management role that internal audit must decline)?

3. The IIA Framework: The Risk Management Role Spectrum

The IIA's position paper on the role of internal auditing in enterprise-wide risk management (often shown as a fan diagram) and the Three Lines Model divide possible internal audit roles into three zones. You must know these cold.

Zone A - Core internal audit roles in ERM (assurance):
- Giving assurance on risk management processes
- Giving assurance that risks are correctly evaluated
- Evaluating risk management processes
- Evaluating the reporting of key risks
- Reviewing the management of key risks

Zone B - Legitimate internal audit roles with safeguards (advisory):
- Facilitating the identification and evaluation of risks
- Coaching management in responding to risks
- Coordinating ERM activities
- Consolidating the reporting on risks
- Maintaining and developing the ERM framework
- Championing the establishment of ERM
- Developing a risk management strategy for board approval

Zone C - Roles internal audit should NOT undertake (management responsibility):
- Setting the risk appetite
- Imposing risk management processes
- Providing management assurance on risks (i.e., being the sole source of assurance that management relies upon as if it were the first or second line)
- Making decisions on risk responses
- Implementing risk responses on management's behalf
- Taking accountability for risk management

The further a request moves from Zone A toward Zone C, the more safeguards are needed, until the point where the request must be refused or restructured.

4. How the Decision Works in Practice

Step 1 - Understand the real need. Ask who is requesting the work, who will rely on the result, and what question they want answered. If the board or audit committee wants to know whether risk management is adequate and effective, that is an assurance need. If management wants help designing, improving, or operating something, that is an advisory need. If management wants internal audit to make the decision or carry the accountability, that is a management role.

Step 2 - Apply the three-party / two-party test. Will a third party (the board, regulators, senior management) rely on an independent conclusion? If yes, assurance. Is the work only for the benefit of the requesting client, with scope agreed between client and auditor? If yes, advisory.

Step 3 - Assess the maturity of risk management. In organizations with immature or no ERM, internal audit cannot meaningfully give assurance on processes that do not yet exist; the appropriate response is usually advisory (championing, facilitating, helping develop the framework) with a plan to transition to assurance once management owns the process. In mature organizations, the primary role shifts to assurance. The CRMA frequently tests this maturity logic.

Step 4 - Evaluate independence and objectivity. Under the Global Internal Audit Standards (Standard 2.1 Individual Objectivity, 2.2 Safeguarding Objectivity, and 7.1 Organizational Independence) and the former Standard 1130, internal auditors must not assess operations for which they were previously responsible, and objectivity is presumed impaired if an auditor provides assurance over an activity they had responsibility for within the previous year. Providing advisory services for areas previously managed is permitted, but potential impairments must be disclosed to the client before accepting the engagement. If a prior advisory role (for example, helping design the risk register) would compromise a later assurance review, the CAE must plan safeguards: different staff, a cooling-off period, co-sourcing, or disclosure to the board.

Step 5 - Confirm no management responsibility is assumed. Former Standard 2120.C3 (carried forward into the Global Standards) is explicit: when assisting management in establishing or improving risk management processes, internal auditors must refrain from assuming any management responsibility by actually managing risks. Internal audit can facilitate a workshop, but management must identify and rate the risks; internal audit can draft a framework for approval, but the board and management must approve and own it.

Step 6 - Apply the safeguards for advisory work. Typical safeguards include: a clear written understanding of objectives, scope, responsibilities, and expectations (engagement terms); documenting that management retains ownership and decision-making; ensuring the advisory role is reflected in the internal audit charter and approved by the board; including significant advisory engagements in the internal audit plan or communicating them to the board; and establishing when and how internal audit will later provide assurance over the area.

Step 7 - Communicate appropriately. Assurance results go to the board and senior management with a conclusion. Advisory results are communicated to the client, with form and distribution agreed. However, if during an advisory engagement internal audit identifies significant governance, risk, or control issues, these must be communicated to senior management and the board regardless of the advisory nature of the engagement. Likewise, knowledge of risks gained during advisory work must be incorporated into the audit function's overall evaluation of risk management processes and risk-based planning.

5. Worked Examples

Request: The audit committee asks whether the enterprise risk assessment presented by the CRO is reliable and complete. Answer: Assurance. Three parties, independent conclusion required, a core role.

Request: A new division head asks internal audit to run a workshop helping the team identify and rate its key risks. Answer: Advisory (facilitation) with safeguards; management rates the risks and owns the output.

Request: Management asks internal audit to decide which operational risks the company should accept versus mitigate. Answer: Decline. Making decisions on risk responses and setting risk appetite is management's responsibility.

Request: The CEO asks internal audit to own and maintain the ERM function permanently because there is no risk manager. Answer: Decline as structured. Internal audit may temporarily champion or help develop the framework (advisory) with board approval and a documented transition plan, but cannot take accountability for risk management.

Request: An internal auditor who managed the treasury function eight months ago is asked to audit the treasury risk controls. Answer: Objectivity impaired for assurance; assign another auditor, defer, or co-source. The same auditor could provide advisory input with disclosure.

Request: Management asks internal audit to prepare the consolidated quarterly risk report for the board. Answer: Legitimate advisory role (consolidating reporting) with safeguards; internal audit should not be the only source of assurance on the content and should avoid being seen as the owner of the risks reported.

6. Communicating and Documenting the Decision

The CAE should document the rationale for classifying an engagement, update the internal audit plan (the Global Standards require the plan to include both assurance and advisory engagements and to be communicated to the board), and ensure the charter authorizes advisory work. When declining or restructuring a request, the CAE should explain the independence rationale to the requester and, where appropriate, inform the board. The board should be made aware of any advisory activity that could later limit internal audit's ability to provide assurance over the same area.

7. Exam Tips: Answering Questions on Choosing Assurance or Advisory for a Risk Request

Tip 1 - Look for the verb. Words such as evaluate, assess, test, verify, conclude, opine, determine whether effective, and provide confidence to the board signal assurance. Words such as facilitate, coach, advise, train, help design, develop for approval, coordinate, champion, and recommend signal advisory. Words such as decide, approve, set appetite, implement, own, manage, and be accountable signal a management role internal audit must refuse.

Tip 2 - Count the parties. If the scenario describes someone other than the requester relying on an independent conclusion, it is assurance (three parties). If the scope is agreed between internal audit and a single client for that client's benefit, it is advisory (two parties).

Tip 3 - Check ERM maturity. If the stem says the organization has no or immature ERM, the best answer usually involves an advisory or championing role with a transition plan, not assurance. If ERM is mature, the best answer emphasizes assurance and preserving independence.

Tip 4 - Eliminate any option where internal audit assumes management responsibility. Options in which internal audit sets risk appetite, makes risk response decisions, implements controls, or is accountable for risk outcomes are virtually always wrong on the CRMA, no matter how helpful they sound.

Tip 5 - Remember the one-year rule and disclosure requirement. Assurance over an area the auditor was responsible for within the past year is presumed impaired. Advisory over such an area is allowed if the impairment is disclosed to the client before acceptance.

Tip 6 - Safeguards beat outright refusal for Zone B roles. When a request falls in the legitimate advisory zone, the best answer is usually to accept with safeguards (documented scope, management ownership, board awareness, staffing separation, planned future assurance), not to refuse. Reserve refusal for Zone C management roles.

Tip 7 - Advisory does not switch off reporting duties. If a question asks what to do when significant risk or control weaknesses are found during an advisory engagement, the correct answer is to communicate them to senior management and the board, and to feed the knowledge into risk-based audit planning.

Tip 8 - The CAE decides, with the board informed. Watch for options implying management alone determines whether an engagement is assurance or advisory, or that the board need not be told about significant advisory work. The CAE makes the classification consistent with the charter and keeps the board informed.

Tip 9 - Prefer the answer that preserves future assurance capability. When two options both seem acceptable, choose the one that protects internal audit's ability to later provide independent assurance over the area, for example using different staff or setting a cooling-off period.

Tip 10 - Read for the word best or most appropriate. CRMA questions often present several defensible actions. The best answer aligns with the Three Lines Model, the Global Internal Audit Standards, keeps management accountable for risk, and keeps internal audit independent and objective.

8. Quick Revision Summary

- Assurance: independent evaluation, three parties, auditor sets scope, conclusion issued, core ERM roles.
- Advisory: improvement and facilitation, two parties, scope agreed with client, recommendations issued, requires safeguards and board awareness.
- Never: setting appetite, deciding or implementing responses, owning or being accountable for risk management.
- Decision drivers: who relies on the result, ERM maturity, independence and objectivity, management ownership, available safeguards.
- Always: document the rationale, reflect in the plan and charter, inform the board, report significant issues, and plan how future assurance will remain possible.