Core Internal Audit Roles in Enterprise Risk Management
5 minutes
5 Questions
In the context of the Certification in Risk Management Assurance (CRMA) and the IIA's guidance on internal audit's role in Enterprise Risk Management (ERM), the 'core' internal audit roles are the assurance activities that internal audit should perform regarding an organization's risk management processes. These roles are fully consistent with internal audit's independent and objective assurance mandate and are often depicted at the center of the IIA's 'fan' diagram of ERM roles. The core roles include: (1) Giving assurance on the risk management processes – evaluating whether the ERM framework is designed appropriately and operating effectively, including risk identification, assessment, response, monitoring, and reporting activities. (2) Giving assurance that risks are correctly evaluated – reviewing whether management's assessments of likelihood and impact are reasonable, consistent, and aligned with the organization's risk appetite. (3) Evaluating risk management processes – assessing the overall maturity of ERM against recognized frameworks such as COSO ERM or ISO 31000. (4) Evaluating the reporting of key risks – confirming that risk information communicated to senior management and the board is accurate, complete, and timely. (5) Reviewing the management of key risks – verifying that controls and risk responses for the most significant risks are adequate and functioning as intended. These roles align with the IIA's International Professional Practices Framework (IPPF) and Global Internal Audit Standards, which require internal audit to evaluate the effectiveness of risk management and contribute to its improvement. Because they are assurance-based, core roles do not compromise independence, unlike legitimate 'consulting' roles (such as facilitating risk workshops or coaching management) that require safeguards, or roles internal audit should never undertake, such as setting risk appetite, owning risks, or making risk response decisions. By performing these core roles, internal audit provides the board and audit committee with confidence that the organization's ERM processes are reliable and that significant risks are managed within acceptable tolerances.
Core Internal Audit Roles in Enterprise Risk Management (ERM): A Complete CRMA Study Guide
1. Why This Topic Matters
The Certification in Risk Management Assurance (CRMA) exam places heavy emphasis on the internal audit activity's relationship with enterprise risk management. The reason is simple: internal auditing exists to provide independent, objective assurance and advisory services that add value and improve an organization's operations, and risk management is at the very heart of that mission. If internal auditors misunderstand which ERM roles are core, which are legitimate only with safeguards, and which are prohibited, they risk compromising their independence and objectivity, becoming part of management, and losing the ability to provide credible assurance to the board.
In practice, boards and audit committees increasingly ask the Chief Audit Executive (CAE) a direct question: Is our risk management working? The internal audit activity is the only function in the organization that is structurally positioned (as the third line in the IIA's Three Lines Model) to answer that question independently. Understanding the core roles is therefore essential both for passing the exam and for performing professionally in the field.
2. What the Core Roles Are
The foundational reference is the IIA Position Paper The Role of Internal Auditing in Enterprise-wide Risk Management, often depicted as a 'fan' diagram divided into three zones. The left-hand zone contains the core internal audit roles in regard to ERM. These are the assurance activities that fall squarely within internal audit's mandate and require no additional safeguards because they do not involve taking on management responsibility. The five core roles are:
(1) Giving assurance on the risk management processes. Internal audit evaluates whether the organization's overall risk management framework is adequately designed, is operating as intended, and is effective in supporting achievement of objectives.
(2) Giving assurance that risks are correctly evaluated. Internal audit assesses whether management has identified the significant risks and has evaluated them appropriately in terms of likelihood, impact, velocity, and other relevant criteria, and whether those evaluations are consistent with the organization's risk appetite and tolerance.
(3) Evaluating risk management processes. Internal audit examines the design and operation of the processes used to identify, assess, respond to, monitor, and report risk across the enterprise, including whether these processes are embedded in planning, decision making, and performance management.
(4) Evaluating the reporting of key risks. Internal audit reviews whether information about key risks is complete, accurate, timely, and communicated to the right levels of management and to the board so that governance bodies can discharge their oversight responsibilities.
(5) Reviewing the management of key risks. Internal audit assesses whether the responses selected by management for the most significant risks (avoid, reduce, share, accept) are appropriate, are actually being implemented, and are operating effectively, and whether residual risk is within acceptable limits.
Collectively, these roles can be summarized in one phrase that often appears in exam answer options: providing objective assurance to the board on the effectiveness of risk management.
3. How the Core Roles Fit Within the Broader Framework
The fan diagram has two other zones that you must be able to distinguish from the core roles.
Legitimate internal audit roles with safeguards (the middle zone) are consulting activities that internal audit may perform provided independence and objectivity are protected. They include: facilitating the identification and evaluation of risks; coaching management in responding to risks; coordinating ERM activities; consolidating the reporting on risks; maintaining and developing the ERM framework; championing the establishment of ERM; and developing a risk management strategy for board approval.
Roles internal audit should NOT undertake (the right-hand zone) are management responsibilities. They include: setting the risk appetite; imposing risk management processes; providing management assurance on risks; taking decisions on risk responses; implementing risk responses on management's behalf; and holding accountability for risk management.
The safeguards that must accompany any role in the middle zone are frequently tested. They are: (a) it should be clear that management remains responsible for risk management; (b) the nature of internal audit's responsibilities should be documented in the internal audit charter and approved by the audit committee; (c) internal audit should not manage any of the risks on behalf of management; (d) internal audit should provide advice, challenge, and support to management's decision making, as opposed to taking risk management decisions itself; (e) internal audit cannot give objective assurance on any part of the ERM framework for which it is responsible, and such assurance should be provided by other suitably qualified parties; and (f) any work beyond assurance activities should be recognized as a consulting engagement, and the relevant standards for consulting engagements should be followed.
4. How the Core Roles Work in Practice
Standards foundation. Under the IIA's Global Internal Audit Standards (effective 2025), Standard 9.1 requires the CAE to develop a comprehensive understanding of the organization's governance, risk management, and control processes, and Standard 9.4 requires a risk-based internal audit plan. The earlier International Standards for the Professional Practice of Internal Auditing contained Standard 2120 (Risk Management), which stated that the internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes, and Standard 2010, which required the audit plan to be based on a documented risk assessment. The core ERM roles are the practical expression of these requirements.
Determining whether risk management processes are effective. The internal auditor forms a judgment based on an assessment of whether: organizational objectives support and align with the mission; significant risks are identified and assessed; appropriate risk responses are selected that align risks with the organization's risk appetite; and relevant risk information is captured and communicated in a timely manner across the organization, enabling staff, management, and the board to carry out their responsibilities.
Methods of gathering evidence. Internal audit may evaluate risk management through multiple engagements that together cover the framework, through a dedicated ERM assurance engagement, through review of risk registers and heat maps, through interviews with risk owners, through testing the operation of key controls that respond to top risks, and through benchmarking against frameworks such as COSO ERM (Integrating with Strategy and Performance) or ISO 31000.
Reporting. The output of the core roles is an independent opinion or conclusion communicated to senior management and the board. Where the organization has no formal ERM process, the auditor brings this to management's attention together with suggestions for establishing one, but the decision and ownership remain with management.
The Three Lines Model perspective. In the IIA's Three Lines Model, management (first line) owns and manages risk; risk management, compliance, and similar functions (second line) provide expertise, support, monitoring, and challenge; and internal audit (third line) provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management. The core roles are precisely the third-line contribution. Internal audit must remain organizationally independent from the first and second lines to perform them credibly.
5. Where Organizations Go Wrong
Common failures include: internal audit taking ownership of the risk register and then auditing its own work; the CAE being appointed Chief Risk Officer without the board approving appropriate safeguards; internal audit setting risk tolerances for business units; and the audit committee receiving risk reports from internal audit as though internal audit were the source of management assurance. Each of these blurs lines and undermines the value of the core assurance roles. The exam often frames such scenarios and asks you to identify the problem or the correct remedy.
6. Exam Tips: Answering Questions on Core Internal Audit Roles in Enterprise Risk Management
Tip 1: Memorize the three zones and the five core roles. The most reliable way to answer classification questions is to recall the fan diagram. If an option describes assurance or evaluation (assuring, evaluating, reviewing), it is a core role. If it describes facilitating, coaching, coordinating, consolidating, championing, maintaining, or developing, it is a legitimate role with safeguards. If it describes setting, imposing, deciding, implementing, or being accountable, it is a prohibited role.
Tip 2: Look for the verb. Exam writers often change only the verb. 'Evaluating the reporting of key risks' is core; 'consolidating the reporting on risks' is legitimate with safeguards; 'providing management assurance on risks' is prohibited. Train yourself to read the action word first.
Tip 3: Remember who owns risk. Any answer implying that internal audit owns, manages, or is accountable for risk is wrong. Management owns risk; the board oversees it; internal audit provides assurance. If a scenario asks what internal audit should do when no ERM process exists, the correct answer is to raise the issue with management and the board and offer suggestions, never to establish and run the process itself.
Tip 4: Know the safeguards by heart. Questions on the middle zone frequently ask which safeguard is required or which is missing. Key phrases to recognize: charter documentation approved by the audit committee, management remains responsible, no assurance on areas for which internal audit is responsible, treat the work as a consulting engagement.
Tip 5: Distinguish independence impairment from objectivity impairment. If the CAE is asked to assume responsibility for an area of ERM, that is a potential impairment, and the question's best answer will usually involve disclosure to the board, obtaining board approval of safeguards, and arranging alternative assurance for that area.
Tip 6: Connect to the Standards. When a question cites a Standard, link it mentally: evaluating the effectiveness of risk management processes and contributing to their improvement is the heart of the mandate; a risk-based plan must flow from a documented risk assessment that considers management's own risk assessment and the input of the board.
Tip 7: Choose the most independent option. When two answers both seem acceptable, the one that preserves greater independence and leaves decisions with management is almost always the IIA's preferred answer.
Tip 8: Watch for 'best', 'most appropriate', and 'should not'. Negative stems ('Which of the following is NOT a core role?') are common in this area. Slow down and confirm whether you are looking for the one inappropriate option or the one appropriate option.
Tip 9: Apply the four effectiveness criteria. If asked how internal audit judges whether risk management is effective, recall: objectives align with mission; significant risks are identified and assessed; responses align with risk appetite; risk information is captured and communicated in a timely manner.
Tip 10: Think like the board. Ask yourself what the audit committee needs from internal audit. It needs an independent view on whether management's risk processes work. Any answer that delivers that, without internal audit stepping into management's shoes, is aligned with the core roles.
7. Quick Revision Summary
Core roles (assurance): assurance on RM processes; assurance that risks are correctly evaluated; evaluating RM processes; evaluating reporting of key risks; reviewing management of key risks.
Legitimate with safeguards (consulting): facilitate, coach, coordinate, consolidate, maintain/develop framework, champion, develop strategy for board approval.
Prohibited (management): set risk appetite, impose processes, management assurance, decide responses, implement responses, accountability for RM.
Safeguards: management responsibility clear; charter documentation and audit committee approval; no managing of risk; advise and challenge only; no self-assurance; treat as consulting.
Master these distinctions and you will be able to handle virtually any CRMA question on internal audit's role in ERM with confidence.
The Certification in Risk Management Assurance (CRMA) exam places heavy emphasis on the internal audit activity's relationship with enterprise risk management. The reason is simple: internal auditing exists to provide independent, objective assurance and advisory services that add value and improve an organization's operations, and risk management is at the very heart of that mission. If internal auditors misunderstand which ERM roles are core, which are legitimate only with safeguards, and which are prohibited, they risk compromising their independence and objectivity, becoming part of management, and losing the ability to provide credible assurance to the board.
In practice, boards and audit committees increasingly ask the Chief Audit Executive (CAE) a direct question: Is our risk management working? The internal audit activity is the only function in the organization that is structurally positioned (as the third line in the IIA's Three Lines Model) to answer that question independently. Understanding the core roles is therefore essential both for passing the exam and for performing professionally in the field.
2. What the Core Roles Are
The foundational reference is the IIA Position Paper The Role of Internal Auditing in Enterprise-wide Risk Management, often depicted as a 'fan' diagram divided into three zones. The left-hand zone contains the core internal audit roles in regard to ERM. These are the assurance activities that fall squarely within internal audit's mandate and require no additional safeguards because they do not involve taking on management responsibility. The five core roles are:
(1) Giving assurance on the risk management processes. Internal audit evaluates whether the organization's overall risk management framework is adequately designed, is operating as intended, and is effective in supporting achievement of objectives.
(2) Giving assurance that risks are correctly evaluated. Internal audit assesses whether management has identified the significant risks and has evaluated them appropriately in terms of likelihood, impact, velocity, and other relevant criteria, and whether those evaluations are consistent with the organization's risk appetite and tolerance.
(3) Evaluating risk management processes. Internal audit examines the design and operation of the processes used to identify, assess, respond to, monitor, and report risk across the enterprise, including whether these processes are embedded in planning, decision making, and performance management.
(4) Evaluating the reporting of key risks. Internal audit reviews whether information about key risks is complete, accurate, timely, and communicated to the right levels of management and to the board so that governance bodies can discharge their oversight responsibilities.
(5) Reviewing the management of key risks. Internal audit assesses whether the responses selected by management for the most significant risks (avoid, reduce, share, accept) are appropriate, are actually being implemented, and are operating effectively, and whether residual risk is within acceptable limits.
Collectively, these roles can be summarized in one phrase that often appears in exam answer options: providing objective assurance to the board on the effectiveness of risk management.
3. How the Core Roles Fit Within the Broader Framework
The fan diagram has two other zones that you must be able to distinguish from the core roles.
Legitimate internal audit roles with safeguards (the middle zone) are consulting activities that internal audit may perform provided independence and objectivity are protected. They include: facilitating the identification and evaluation of risks; coaching management in responding to risks; coordinating ERM activities; consolidating the reporting on risks; maintaining and developing the ERM framework; championing the establishment of ERM; and developing a risk management strategy for board approval.
Roles internal audit should NOT undertake (the right-hand zone) are management responsibilities. They include: setting the risk appetite; imposing risk management processes; providing management assurance on risks; taking decisions on risk responses; implementing risk responses on management's behalf; and holding accountability for risk management.
The safeguards that must accompany any role in the middle zone are frequently tested. They are: (a) it should be clear that management remains responsible for risk management; (b) the nature of internal audit's responsibilities should be documented in the internal audit charter and approved by the audit committee; (c) internal audit should not manage any of the risks on behalf of management; (d) internal audit should provide advice, challenge, and support to management's decision making, as opposed to taking risk management decisions itself; (e) internal audit cannot give objective assurance on any part of the ERM framework for which it is responsible, and such assurance should be provided by other suitably qualified parties; and (f) any work beyond assurance activities should be recognized as a consulting engagement, and the relevant standards for consulting engagements should be followed.
4. How the Core Roles Work in Practice
Standards foundation. Under the IIA's Global Internal Audit Standards (effective 2025), Standard 9.1 requires the CAE to develop a comprehensive understanding of the organization's governance, risk management, and control processes, and Standard 9.4 requires a risk-based internal audit plan. The earlier International Standards for the Professional Practice of Internal Auditing contained Standard 2120 (Risk Management), which stated that the internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes, and Standard 2010, which required the audit plan to be based on a documented risk assessment. The core ERM roles are the practical expression of these requirements.
Determining whether risk management processes are effective. The internal auditor forms a judgment based on an assessment of whether: organizational objectives support and align with the mission; significant risks are identified and assessed; appropriate risk responses are selected that align risks with the organization's risk appetite; and relevant risk information is captured and communicated in a timely manner across the organization, enabling staff, management, and the board to carry out their responsibilities.
Methods of gathering evidence. Internal audit may evaluate risk management through multiple engagements that together cover the framework, through a dedicated ERM assurance engagement, through review of risk registers and heat maps, through interviews with risk owners, through testing the operation of key controls that respond to top risks, and through benchmarking against frameworks such as COSO ERM (Integrating with Strategy and Performance) or ISO 31000.
Reporting. The output of the core roles is an independent opinion or conclusion communicated to senior management and the board. Where the organization has no formal ERM process, the auditor brings this to management's attention together with suggestions for establishing one, but the decision and ownership remain with management.
The Three Lines Model perspective. In the IIA's Three Lines Model, management (first line) owns and manages risk; risk management, compliance, and similar functions (second line) provide expertise, support, monitoring, and challenge; and internal audit (third line) provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management. The core roles are precisely the third-line contribution. Internal audit must remain organizationally independent from the first and second lines to perform them credibly.
5. Where Organizations Go Wrong
Common failures include: internal audit taking ownership of the risk register and then auditing its own work; the CAE being appointed Chief Risk Officer without the board approving appropriate safeguards; internal audit setting risk tolerances for business units; and the audit committee receiving risk reports from internal audit as though internal audit were the source of management assurance. Each of these blurs lines and undermines the value of the core assurance roles. The exam often frames such scenarios and asks you to identify the problem or the correct remedy.
6. Exam Tips: Answering Questions on Core Internal Audit Roles in Enterprise Risk Management
Tip 1: Memorize the three zones and the five core roles. The most reliable way to answer classification questions is to recall the fan diagram. If an option describes assurance or evaluation (assuring, evaluating, reviewing), it is a core role. If it describes facilitating, coaching, coordinating, consolidating, championing, maintaining, or developing, it is a legitimate role with safeguards. If it describes setting, imposing, deciding, implementing, or being accountable, it is a prohibited role.
Tip 2: Look for the verb. Exam writers often change only the verb. 'Evaluating the reporting of key risks' is core; 'consolidating the reporting on risks' is legitimate with safeguards; 'providing management assurance on risks' is prohibited. Train yourself to read the action word first.
Tip 3: Remember who owns risk. Any answer implying that internal audit owns, manages, or is accountable for risk is wrong. Management owns risk; the board oversees it; internal audit provides assurance. If a scenario asks what internal audit should do when no ERM process exists, the correct answer is to raise the issue with management and the board and offer suggestions, never to establish and run the process itself.
Tip 4: Know the safeguards by heart. Questions on the middle zone frequently ask which safeguard is required or which is missing. Key phrases to recognize: charter documentation approved by the audit committee, management remains responsible, no assurance on areas for which internal audit is responsible, treat the work as a consulting engagement.
Tip 5: Distinguish independence impairment from objectivity impairment. If the CAE is asked to assume responsibility for an area of ERM, that is a potential impairment, and the question's best answer will usually involve disclosure to the board, obtaining board approval of safeguards, and arranging alternative assurance for that area.
Tip 6: Connect to the Standards. When a question cites a Standard, link it mentally: evaluating the effectiveness of risk management processes and contributing to their improvement is the heart of the mandate; a risk-based plan must flow from a documented risk assessment that considers management's own risk assessment and the input of the board.
Tip 7: Choose the most independent option. When two answers both seem acceptable, the one that preserves greater independence and leaves decisions with management is almost always the IIA's preferred answer.
Tip 8: Watch for 'best', 'most appropriate', and 'should not'. Negative stems ('Which of the following is NOT a core role?') are common in this area. Slow down and confirm whether you are looking for the one inappropriate option or the one appropriate option.
Tip 9: Apply the four effectiveness criteria. If asked how internal audit judges whether risk management is effective, recall: objectives align with mission; significant risks are identified and assessed; responses align with risk appetite; risk information is captured and communicated in a timely manner.
Tip 10: Think like the board. Ask yourself what the audit committee needs from internal audit. It needs an independent view on whether management's risk processes work. Any answer that delivers that, without internal audit stepping into management's shoes, is aligned with the core roles.
7. Quick Revision Summary
Core roles (assurance): assurance on RM processes; assurance that risks are correctly evaluated; evaluating RM processes; evaluating reporting of key risks; reviewing management of key risks.
Legitimate with safeguards (consulting): facilitate, coach, coordinate, consolidate, maintain/develop framework, champion, develop strategy for board approval.
Prohibited (management): set risk appetite, impose processes, management assurance, decide responses, implement responses, accountability for RM.
Safeguards: management responsibility clear; charter documentation and audit committee approval; no managing of risk; advise and challenge only; no self-assurance; treat as consulting.
Master these distinctions and you will be able to handle virtually any CRMA question on internal audit's role in ERM with confidence.
Test mode:
CRMA - Core Internal Audit Roles in Enterprise Risk Management Example Questions
Test your knowledge of Core Internal Audit Roles in Enterprise Risk Management
Question 1
As an organization launches enterprise risk management, senior management asks the internal audit function to support the rollout through several activities. The chief audit executive is willing to accept roles that help the process, provided the function's independence and objectivity are preserved. Which request should the chief audit executive decline?
Question 2
Which activity is a core assurance role of internal audit in enterprise risk management, rather than a role it may assume only with safeguards in place?
Question 3
An organization has no chief risk officer, and the board asks the chief audit executive to help launch enterprise risk management. Senior management proposes that internal audit run risk workshops, keep the risk register, and calibrate risk appetite thresholds for board approval. The audit committee wants internal audit to keep giving assurance over the program later. Which response by the chief audit executive is MOST appropriate?
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3053 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Core Internal Audit Roles in Enterprise Risk Management questions
17 questions (total)
Other Internal Audit Roles and Responsibilities concepts
Advisory and Consulting Services on Risk ManagementAdvocating for Enterprise Risk ManagementAssessing Internal Audit Skill GapsAssurance Services on Risk ManagementBuilding an Organizationwide Risk Assurance MapChief Audit Executive Roles Beyond Internal AuditingChoosing Assurance or Advisory for a Risk RequestCombined AssuranceCompetencies for Risk Management AssuranceCoordinating Assurance Across ProvidersCo-Sourcing and Outsourcing Risk ExpertiseDeclining or Adjusting Work That Lacks CompetenceDeveloping Risk Management Competence in StaffEvaluating Reliance on Other Assurance ProvidersFinding Gaps and Overlaps with an Assurance MapFunctional and Administrative Reporting LinesImpairments from Risk Management ResponsibilitiesImproving Existing Risk Management ProcessesInternal Audit ERM Roles That Need SafeguardsInternal Audit's Role When No Risk Process ExistsMaintaining and Updating the Assurance MapOrganizational Independence of Internal AuditRecommending an Organizationwide Risk StrategyRelying on External Auditors and RegulatorsReporting Impairments to the Board and ManagementRoles Internal Audit Should Not Take in ERMSafeguards When Internal Audit Leads Risk WorkThe Three Lines ModelUsing External Experts in Risk Engagements