Developing Risk Management Competence in Staff

1. Why This Topic Matters

The Certification in Risk Management Assurance (CRMA) exam tests whether internal auditors can provide assurance and advisory services over an organization's risk management processes. A recurring theme in the Internal Audit Roles and Responsibilities domain is that internal audit can only add value in risk management if its own people are competent in it. The IIA's International Standards for the Professional Practice of Internal Auditing (and the 2024 Global Internal Audit Standards) require that the internal audit function collectively possess the knowledge, skills, and other competencies needed to perform its responsibilities. Risk management competence is explicitly identified as one of those competencies.

Developing risk management competence in staff is important for several reasons:

• Quality of assurance – Auditors who do not understand risk frameworks (COSO ERM, ISO 31000), risk appetite, risk tolerance, inherent versus residual risk, and risk response strategies cannot credibly evaluate whether management's risk processes are effective.
• Credibility with the board and management – Risk owners and executives expect the internal audit function to speak the language of risk and to challenge risk assessments intelligently.
• Protecting independence – Competent staff know where the line is between assurance roles, legitimate consulting roles (with safeguards), and roles internal audit should not undertake (per the IIA Position Paper on the Three Lines Model and the "fan" of roles in ERM). Poorly trained auditors drift into management responsibilities.
• Due professional care – Standards require auditors to apply the care and skill expected of a reasonably prudent and competent auditor. Risk literacy is part of that care.
• Organizational risk maturity – Internal audit frequently acts as a catalyst for improving enterprise risk management (ERM). It cannot champion good practice it does not itself understand.

2. What It Is

Developing risk management competence in staff refers to the systematic process by which the Chief Audit Executive (CAE) ensures that individual auditors and the internal audit function as a whole acquire, maintain, and continually improve the knowledge, skills, and behaviors required to evaluate and advise on risk management. It covers:

• Knowledge – Risk management frameworks (COSO ERM 2017, ISO 31000:2018), governance structures, risk appetite and tolerance concepts, risk identification and assessment techniques, key risk indicators (KRIs), risk culture, emerging and strategic risks, and industry-specific risks.
• Skills – Facilitating risk workshops, applying quantitative and qualitative risk assessment methods, data analytics, control evaluation, root cause analysis, scenario analysis, and communicating risk information to senior stakeholders.
• Behaviors and attributes – Professional skepticism, objectivity, business acumen, critical thinking, and the judgment to recognize independence threats when performing consulting roles in ERM.

It is both an individual responsibility (each auditor must enhance their own proficiency through continuing professional development, as required by the Code of Ethics principle of Competency) and a functional responsibility (the CAE must ensure the collective competence of the team and obtain competent advice and assistance when the team lacks a needed skill).

3. How It Works – The Competence Development Cycle

Step 1: Define required competencies. The CAE, often using the IIA's Internal Audit Competency Framework and the organization's risk universe, identifies what risk management knowledge and skills the function needs. This is linked to the audit plan: if the plan includes assurance over ERM, cyber risk, third-party risk, or model risk, the required competencies follow from that.

Step 2: Assess current competencies. Tools include skills inventories, self-assessments, supervisory evaluations, performance reviews, and results from the Quality Assurance and Improvement Program (QAIP). The result is a gap analysis comparing required competencies to existing ones.

Step 3: Build a development plan. Gaps are closed through a mix of methods:
• Formal training and certifications (CRMA, CIA, CISA, FRM, or ISO 31000 training).
• On-the-job development – rotating staff onto risk-focused engagements, pairing junior staff with experienced risk auditors, and participating in or observing management's risk assessment workshops.
• Guest auditor and rotational programs that bring business and risk-function staff into internal audit (with safeguards to protect objectivity).
• Mentoring, coaching, and knowledge-sharing sessions.
• Use of co-sourcing or outsourcing – when expertise is unavailable internally, the CAE must obtain competent advice and assistance (e.g., specialists in actuarial, cyber, or quantitative risk modeling). The CAE remains responsible for the engagement and for ensuring the external provider's competence.
• Continuing Professional Education (CPE) requirements for certified staff.

Step 4: Deliver and apply learning. Competence is reinforced by applying knowledge on engagements, supported by supervision and review. Engagement supervision is a key control for ensuring that less experienced staff reach sound conclusions about risk.

Step 5: Monitor, evaluate, and report. The CAE tracks training hours, certification achievement, engagement quality metrics, client feedback, and QAIP results. Competency status and significant gaps may be reported to the board/audit committee as part of reporting on the function's resources (the Standards require the CAE to communicate the impact of resource limitations). The cycle then repeats as the risk environment and audit plan evolve.

Key Standards and Guidance Links
• Code of Ethics – Competency principle: engage only in services for which one has the necessary knowledge, skills, and experience; continually improve proficiency.
• Proficiency and Due Professional Care standard (formerly Standard 1200 series; Domain III Governing and Domain IV Managing in the 2024 Global Standards): the CAE must obtain competent advice and assistance if staff lack the knowledge, skills, or other competencies needed.
• Continuing Professional Development requirement.
• Resource management: the CAE must ensure resources are appropriate, sufficient, and effectively deployed.
• IIA Position Paper on the Three Lines Model and guidance on internal audit's role in ERM: core assurance roles, legitimate consulting roles with safeguards, and roles internal audit should not undertake (setting risk appetite, owning risks, making risk response decisions).
• Quality Assurance and Improvement Program: internal and external assessments evaluate staff proficiency.

4. Common Scenarios the Exam Uses

• The audit plan includes an ERM maturity assessment but no staff have ERM experience. Best answer: the CAE should arrange training and/or obtain competent external assistance (co-source) while retaining responsibility; the CAE should not simply drop the engagement without reporting the resource limitation, nor assign untrained staff and hope for the best.
• An auditor is asked to facilitate a risk workshop for management. Best answer: this is a legitimate consulting role provided safeguards exist (management retains ownership of risk identification and response; the auditor facilitates but does not decide). Competence in facilitation and risk frameworks is required.
• A staff auditor previously worked in the risk management department and is assigned to audit ERM. Best answer: an objectivity impairment exists for at least one year regarding activities they were responsible for; competence does not override objectivity requirements.
• The CAE wants to measure whether training improved competence. Best answer: use outcome-based measures such as engagement quality reviews, QAIP results, stakeholder feedback, and supervisory assessments – not just hours attended.
• The board asks whether internal audit is qualified to assess risk management. Best answer: the CAE should present the competency framework, gap analysis, certifications, training plan, and any co-sourcing arrangements, and disclose limitations honestly.

5. Exam Tips: Answering Questions on Developing Risk Management Competence in Staff

Tip 1 – Anchor on the Standards. Whenever a question involves missing skills, recall the three-part rule: (a) the function must collectively possess required competencies, (b) individuals must continually improve, and (c) the CAE must obtain competent advice and assistance when gaps exist. Answers that reflect this language are usually correct.

Tip 2 – The CAE remains accountable. Even when co-sourcing or using guest auditors, the CAE is responsible for the quality of the work and for verifying the provider's competence and independence. Options that transfer accountability to a third party are wrong.

Tip 3 – Competence never overrides independence and objectivity. If an option solves a skill gap by having internal audit take on management responsibilities (setting risk appetite, owning risk responses, implementing ERM), eliminate it. Likewise, a highly competent former risk manager still has a one-year objectivity restriction on their previous area.

Tip 4 – Distinguish "collective" from "individual." Not every auditor must be an expert in every risk area. The exam tests whether you know that the function as a whole must have the competencies, while each auditor must have those needed for their assigned work.

Tip 5 – Prefer systematic, risk-based approaches. Answers describing a competency framework, gap analysis, development plan, and monitoring loop beat ad hoc answers such as "send everyone to a seminar." Look for the choice that links training needs to the audit plan and the organization's risk profile.

Tip 6 – Measure outcomes, not inputs. When asked how to evaluate competence development, choose outcome-oriented measures (engagement quality, QAIP findings, stakeholder feedback, achievement of certifications) over input measures (training hours, budget spent).

Tip 7 – Watch for "report limitations" answers. If resources or competencies are insufficient to execute the risk-based plan, the CAE must communicate the impact to senior management and the board. An option that quietly reduces scope without disclosure is incorrect.

Tip 8 – Know the ERM role fan. Core assurance roles (giving assurance on risk management processes, on risk evaluation, on reporting of key risks) require risk competence; legitimate consulting roles (facilitating workshops, coaching management, championing ERM) require competence plus safeguards; prohibited roles (setting appetite, taking risk decisions, implementing responses on management's behalf) are never acceptable regardless of competence.

Tip 9 – Read for the "best" or "most appropriate" qualifier. Several options may be partially correct. The best answer typically combines development of internal staff with appropriate supplementary resources and clear reporting, aligned to Standards terminology.

Tip 10 – Remember the Code of Ethics. Questions phrased around an individual auditor accepting an assignment they are not qualified for are testing the Competency principle: the auditor should disclose the limitation and seek guidance or training, not accept the work silently.

6. Quick Revision Summary

• Risk management competence is a Standards requirement, not optional.
• Collective proficiency of the function + individual continuous improvement.
• CAE assesses gaps, develops staff, and obtains external assistance when necessary – while remaining accountable.
• Competence enables assurance and legitimate consulting roles in ERM but never justifies assuming management's risk responsibilities.
• Development is cyclical: define – assess – plan – deliver – monitor – report.
• On the exam, choose systematic, Standards-aligned, outcome-measured, independence-preserving answers.