Impairments from Risk Management Responsibilities
5 minutes
5 Questions
In the context of the Certification in Risk Management Assurance (CRMA) and internal audit roles, 'impairments from risk management responsibilities' refers to threats to the internal audit function's independence and objectivity that arise when internal auditors take on roles that belong to management in the risk management process. The IIA's International Standards (and the IIA Position Paper on the Three Lines Model) make clear that management owns risk: it identifies, assesses, responds to, and monitors risks. Internal audit's core role is to provide independent assurance that these processes are designed and operating effectively. An impairment occurs when auditors cross this line—for example, by setting the organization's risk appetite, deciding on risk responses, implementing risk controls, taking accountability for risk management outcomes, or managing the ERM function on management's behalf. Once internal audit performs such activities, it cannot objectively audit them, because it would effectively be reviewing its own work, creating a self-review threat. The IIA's 'fan' model of ERM roles distinguishes core assurance roles (e.g., evaluating risk processes and reporting on key risks), legitimate consulting roles permitted with safeguards (e.g., facilitating risk workshops, coaching management, championing ERM), and roles internal audit should not undertake (e.g., owning risks, making risk decisions, implementing responses). Where auditors do take on consulting or facilitation activities, safeguards are required: clear documentation that management retains ownership, disclosure of the nature of the involvement, and ensuring that auditors do not later provide assurance over areas where they held operational responsibility, generally for at least one year. Standards 1120 and 1130 require individual auditors to avoid conflicts of interest and to disclose any impairment in fact or appearance to the Chief Audit Executive and, where significant, to the board. If the CAE has risk management duties, oversight of that area must be arranged from outside internal audit. Recognizing and managing these impairments preserves the credibility and value of internal audit's risk assurance.
Impairments from Risk Management Responsibilities: A Complete CRMA Study Guide
Why This Topic Matters
The CRMA (Certification in Risk Management Assurance) exam tests whether you understand the boundary between providing assurance on risk management and owning risk management. Internal auditors are frequently invited to help build, run, or lead enterprise risk management (ERM) programs, especially in smaller organizations or those with immature risk functions. Every such invitation carries a potential threat to independence and objectivity. If internal audit takes on management's responsibilities for risk, it can no longer provide the board with credible, unbiased assurance about how well those risks are being managed. This topic sits at the heart of Domain I of the CRMA syllabus (Internal Audit Roles and Responsibilities) and is heavily tested because it requires judgment, not just memorization.
What an Impairment Is
An impairment is any condition that threatens, in fact or in appearance, the independence of the internal audit activity or the objectivity of individual auditors. The IIA's Standards describe independence as freedom from conditions that threaten the ability to carry out responsibilities in an unbiased manner, and objectivity as an unbiased mental attitude that allows auditors to perform engagements without compromising quality or subordinating judgment to others.
When applied to risk management, an impairment arises when internal audit:
- Makes or influences management decisions about which risks to accept, avoid, transfer, or mitigate.
- Designs, implements, or operates risk responses or controls.
- Becomes accountable for the results of risk management.
- Later provides assurance over work it performed or decisions it made.
The key test is simple: Who is responsible and accountable? If internal audit is accountable for risk management outcomes, its independence is impaired.
The IIA Framework: Core Roles, Legitimate Roles with Safeguards, and Prohibited Roles
The IIA Position Paper The Role of Internal Auditing in Enterprise-wide Risk Management uses the well-known fan diagram to divide internal audit's possible ERM activities into three zones. You must know all three.
1. Core internal audit roles in ERM (assurance roles - no impairment)
- Giving assurance on risk management processes.
- Giving assurance that risks are correctly evaluated.
- Evaluating risk management processes.
- Evaluating the reporting of key risks.
- Reviewing the management of key risks.
2. Legitimate roles with safeguards (consulting roles - acceptable if protected)
- Facilitating identification and evaluation of risks.
- Coaching management in responding to risks.
- Coordinating ERM activities.
- Consolidating reporting on risks.
- Maintaining and developing the ERM framework.
- Championing establishment of ERM.
- Developing a risk management strategy for board approval.
3. Roles internal audit should NOT undertake (impairments)
- Setting the risk appetite.
- Imposing risk management processes.
- Providing management assurance on risks (i.e., acting as the first or second line giving assurance to itself).
- Taking decisions on risk responses.
- Implementing risk responses on management's behalf.
- Accountability for risk management.
Memorize the third list. Exam questions repeatedly describe one of these six activities in disguised language and ask you to recognize it as unacceptable.
How the Standards Address This
IIA Standards (2017 IPPF)
- Standard 1130 - Impairment to Independence or Objectivity: if independence or objectivity is impaired in fact or appearance, details must be disclosed to appropriate parties.
- 1130.A1: auditors must refrain from assessing specific operations for which they were previously responsible; objectivity is presumed impaired if an auditor provides assurance over an activity for which they had responsibility within the previous year.
- 1130.A2: assurance engagements for functions over which the chief audit executive (CAE) has responsibility must be overseen by a party outside the internal audit activity.
- 1130.A3: internal audit may provide assurance where it previously performed consulting services, provided the nature of the consulting did not impair objectivity and individual objectivity is managed when assigning resources.
- 1130.C1 and C2: auditors may provide consulting services relating to operations for which they had previous responsibilities, but potential impairments must be disclosed to the client before accepting the engagement.
- Standard 1112 - CAE Roles Beyond Internal Auditing: where the CAE has or is expected to have roles beyond internal auditing (such as leading risk management), safeguards must be in place to limit impairments.
- Standard 2120 - Risk Management: internal audit must evaluate the effectiveness and contribute to the improvement of risk management processes.
- 2120.C3: when assisting management in establishing or improving risk management processes, internal auditors must refrain from assuming any management responsibility by actually managing risks.
Global Internal Audit Standards (2024)
- Standard 7.1 - Organizational Independence: the board must approve any additional roles assigned to the CAE, and safeguards must be established and periodically evaluated.
- Standard 7.2 - Auditor Objectivity: auditors must not assess activities for which they were responsible within the prior year and must disclose impairments.
- Standard 9.1 and 9.4: the CAE must understand governance, risk management, and control processes and may provide advisory services, but without assuming management responsibility.
The Three Lines Model
The IIA's Three Lines Model (2020) reinforces this: the first line owns and manages risk, the second line provides expertise, support, monitoring, and challenge on risk matters, and the third line (internal audit) provides independent assurance. When internal audit performs first- or second-line activities, it blends roles and the governing body must be made aware and establish safeguards.
How Impairments Typically Arise in Practice
- The CAE as Chief Risk Officer: a common dual-hat arrangement in smaller organizations. Acceptable only with board approval, documentation in the charter, and independent assurance over risk management from another party.
- Building the ERM framework: designing the framework is a legitimate consulting role, but the auditor who designed it should not audit it for at least a year, and the organization must own and approve it.
- Chairing a risk committee: chairing implies decision-making authority; participating as an advisor or observer is acceptable.
- Maintaining the risk register: consolidating and reporting is legitimate with safeguards; deciding which risks go on the register, their ratings, and their responses is management's job.
- Approving risk responses or signing off on risk acceptance: always an impairment.
- Performing control self-assessment for management: facilitating CSA is fine; completing it and attesting on management's behalf is not.
- Pressure from management: scope limitations, pressure to change ratings, or restrictions on access also impair independence even without a role conflict.
Safeguards That Reduce or Manage Impairments
When a question asks how to handle a potential impairment, the strongest answers involve these safeguards:
1. Board or audit committee approval of any non-audit role, with the arrangement documented in the internal audit charter.
2. Full disclosure of the nature of the impairment to the board, the audit committee, and relevant stakeholders.
3. Management retains ownership - all decisions, approvals, and accountability remain with management; internal audit advises only.
4. Time limits - the role is temporary and transitions to management as risk maturity grows.
5. Separation of staff - auditors who performed risk management work do not audit that area for at least one year.
6. External or independent assurance over the risk management activities for which internal audit has responsibility (per 1130.A2).
7. Periodic evaluation of the safeguards by the board and the CAE.
8. Clear communication of internal audit's role to the organization so that management does not assume internal audit owns risk.
Exam Tips: Answering Questions on Impairments from Risk Management Responsibilities
Tip 1 - Apply the ownership test first. Read the scenario and ask: does this activity make internal audit responsible or accountable for a risk outcome? Words like decide, approve, implement, set, own, manage, direct, impose, sign off, and responsible for signal an impairment. Words like facilitate, coach, advise, coordinate, consolidate, recommend, evaluate, and assess signal acceptable roles.
Tip 2 - Know the fan diagram cold. Many questions present a list of activities and ask which one internal audit should never perform. The six prohibited roles are: setting risk appetite, imposing risk processes, providing management assurance on risks, deciding risk responses, implementing risk responses, and being accountable for risk management. If one of these appears, it is almost certainly the answer.
Tip 3 - Distinguish assurance from consulting. Consulting engagements allow far more involvement in risk management, provided management retains decisions. Assurance engagements require strict independence. If the scenario says the engagement is advisory and management will make the decisions, the activity is usually acceptable.
Tip 4 - Remember the one-year rule. Objectivity is presumed impaired if an auditor provides assurance over an area for which they had operational responsibility within the past year. If a question involves a recently transferred employee or an auditor who built a risk process, the correct answer typically assigns a different auditor or defers the audit.
Tip 5 - When the CAE wears two hats, think 'board approval plus independent oversight.' The best answer for CAE-as-CRO scenarios combines board approval, charter documentation, disclosure, and assurance over the risk function being provided by someone outside internal audit (such as an external provider or another independent party).
Tip 6 - Disclosure is required, not optional. If an impairment exists in fact or appearance, the Standards require disclosure to appropriate parties. Answers that suggest ignoring, hiding, or simply accepting an impairment without disclosure are wrong. Answers that suggest disclosure to the board and the engagement client are strong.
Tip 7 - 'Appearance' counts as much as 'fact.' Even when the auditor believes they can remain objective, a reasonable third party's perception matters. Eliminate answers that rely on the auditor's personal confidence in their own objectivity.
Tip 8 - Favor answers that preserve management ownership. When asked how internal audit can help an organization with immature ERM, the best answer lets internal audit champion, facilitate, and develop a framework for board approval while management owns the risks and responses. Avoid answers where internal audit 'takes charge until management is ready' without safeguards.
Tip 9 - Watch for the 'most appropriate' wording. Several options may be partially correct. The most appropriate answer generally involves the board or audit committee, documents the arrangement, and limits the duration. A purely informal or verbal arrangement is rarely the best answer.
Tip 10 - Connect to the Three Lines Model. If a question references the Three Lines Model, remember that internal audit is the third line and should not perform first-line (owning risk) or second-line (monitoring and challenging as part of management) functions without the governing body being informed and safeguards in place.
Tip 11 - Scope and access restrictions are also impairments. Not every impairment comes from a role conflict. If management restricts scope, limits access to records or personnel, or pressures the auditor to alter findings, that is an impairment that must be reported to the board.
Tip 12 - Eliminate extreme answers. Options stating internal audit may 'never' be involved in ERM or may 'always' lead ERM are usually wrong. The Standards and Position Paper allow involvement with safeguards; the exam rewards nuanced, judgment-based answers.
Quick Recall Summary
- Internal audit's primary role in ERM is to evaluate and give assurance on risk management processes.
- Internal audit may facilitate, coach, coordinate, consolidate, and champion with safeguards.
- Internal audit must never set risk appetite, decide or implement responses, impose processes, give management assurance, or be accountable for risk management.
- Impairments in fact or appearance must be disclosed.
- No assurance over areas of prior responsibility within one year.
- CAE additional roles require board approval, charter documentation, safeguards, and independent assurance.
Master these principles and practice applying the ownership test to scenario-based questions, and you will handle every impairment question the CRMA exam presents.
The CRMA (Certification in Risk Management Assurance) exam tests whether you understand the boundary between providing assurance on risk management and owning risk management. Internal auditors are frequently invited to help build, run, or lead enterprise risk management (ERM) programs, especially in smaller organizations or those with immature risk functions. Every such invitation carries a potential threat to independence and objectivity. If internal audit takes on management's responsibilities for risk, it can no longer provide the board with credible, unbiased assurance about how well those risks are being managed. This topic sits at the heart of Domain I of the CRMA syllabus (Internal Audit Roles and Responsibilities) and is heavily tested because it requires judgment, not just memorization.
What an Impairment Is
An impairment is any condition that threatens, in fact or in appearance, the independence of the internal audit activity or the objectivity of individual auditors. The IIA's Standards describe independence as freedom from conditions that threaten the ability to carry out responsibilities in an unbiased manner, and objectivity as an unbiased mental attitude that allows auditors to perform engagements without compromising quality or subordinating judgment to others.
When applied to risk management, an impairment arises when internal audit:
- Makes or influences management decisions about which risks to accept, avoid, transfer, or mitigate.
- Designs, implements, or operates risk responses or controls.
- Becomes accountable for the results of risk management.
- Later provides assurance over work it performed or decisions it made.
The key test is simple: Who is responsible and accountable? If internal audit is accountable for risk management outcomes, its independence is impaired.
The IIA Framework: Core Roles, Legitimate Roles with Safeguards, and Prohibited Roles
The IIA Position Paper The Role of Internal Auditing in Enterprise-wide Risk Management uses the well-known fan diagram to divide internal audit's possible ERM activities into three zones. You must know all three.
1. Core internal audit roles in ERM (assurance roles - no impairment)
- Giving assurance on risk management processes.
- Giving assurance that risks are correctly evaluated.
- Evaluating risk management processes.
- Evaluating the reporting of key risks.
- Reviewing the management of key risks.
2. Legitimate roles with safeguards (consulting roles - acceptable if protected)
- Facilitating identification and evaluation of risks.
- Coaching management in responding to risks.
- Coordinating ERM activities.
- Consolidating reporting on risks.
- Maintaining and developing the ERM framework.
- Championing establishment of ERM.
- Developing a risk management strategy for board approval.
3. Roles internal audit should NOT undertake (impairments)
- Setting the risk appetite.
- Imposing risk management processes.
- Providing management assurance on risks (i.e., acting as the first or second line giving assurance to itself).
- Taking decisions on risk responses.
- Implementing risk responses on management's behalf.
- Accountability for risk management.
Memorize the third list. Exam questions repeatedly describe one of these six activities in disguised language and ask you to recognize it as unacceptable.
How the Standards Address This
IIA Standards (2017 IPPF)
- Standard 1130 - Impairment to Independence or Objectivity: if independence or objectivity is impaired in fact or appearance, details must be disclosed to appropriate parties.
- 1130.A1: auditors must refrain from assessing specific operations for which they were previously responsible; objectivity is presumed impaired if an auditor provides assurance over an activity for which they had responsibility within the previous year.
- 1130.A2: assurance engagements for functions over which the chief audit executive (CAE) has responsibility must be overseen by a party outside the internal audit activity.
- 1130.A3: internal audit may provide assurance where it previously performed consulting services, provided the nature of the consulting did not impair objectivity and individual objectivity is managed when assigning resources.
- 1130.C1 and C2: auditors may provide consulting services relating to operations for which they had previous responsibilities, but potential impairments must be disclosed to the client before accepting the engagement.
- Standard 1112 - CAE Roles Beyond Internal Auditing: where the CAE has or is expected to have roles beyond internal auditing (such as leading risk management), safeguards must be in place to limit impairments.
- Standard 2120 - Risk Management: internal audit must evaluate the effectiveness and contribute to the improvement of risk management processes.
- 2120.C3: when assisting management in establishing or improving risk management processes, internal auditors must refrain from assuming any management responsibility by actually managing risks.
Global Internal Audit Standards (2024)
- Standard 7.1 - Organizational Independence: the board must approve any additional roles assigned to the CAE, and safeguards must be established and periodically evaluated.
- Standard 7.2 - Auditor Objectivity: auditors must not assess activities for which they were responsible within the prior year and must disclose impairments.
- Standard 9.1 and 9.4: the CAE must understand governance, risk management, and control processes and may provide advisory services, but without assuming management responsibility.
The Three Lines Model
The IIA's Three Lines Model (2020) reinforces this: the first line owns and manages risk, the second line provides expertise, support, monitoring, and challenge on risk matters, and the third line (internal audit) provides independent assurance. When internal audit performs first- or second-line activities, it blends roles and the governing body must be made aware and establish safeguards.
How Impairments Typically Arise in Practice
- The CAE as Chief Risk Officer: a common dual-hat arrangement in smaller organizations. Acceptable only with board approval, documentation in the charter, and independent assurance over risk management from another party.
- Building the ERM framework: designing the framework is a legitimate consulting role, but the auditor who designed it should not audit it for at least a year, and the organization must own and approve it.
- Chairing a risk committee: chairing implies decision-making authority; participating as an advisor or observer is acceptable.
- Maintaining the risk register: consolidating and reporting is legitimate with safeguards; deciding which risks go on the register, their ratings, and their responses is management's job.
- Approving risk responses or signing off on risk acceptance: always an impairment.
- Performing control self-assessment for management: facilitating CSA is fine; completing it and attesting on management's behalf is not.
- Pressure from management: scope limitations, pressure to change ratings, or restrictions on access also impair independence even without a role conflict.
Safeguards That Reduce or Manage Impairments
When a question asks how to handle a potential impairment, the strongest answers involve these safeguards:
1. Board or audit committee approval of any non-audit role, with the arrangement documented in the internal audit charter.
2. Full disclosure of the nature of the impairment to the board, the audit committee, and relevant stakeholders.
3. Management retains ownership - all decisions, approvals, and accountability remain with management; internal audit advises only.
4. Time limits - the role is temporary and transitions to management as risk maturity grows.
5. Separation of staff - auditors who performed risk management work do not audit that area for at least one year.
6. External or independent assurance over the risk management activities for which internal audit has responsibility (per 1130.A2).
7. Periodic evaluation of the safeguards by the board and the CAE.
8. Clear communication of internal audit's role to the organization so that management does not assume internal audit owns risk.
Exam Tips: Answering Questions on Impairments from Risk Management Responsibilities
Tip 1 - Apply the ownership test first. Read the scenario and ask: does this activity make internal audit responsible or accountable for a risk outcome? Words like decide, approve, implement, set, own, manage, direct, impose, sign off, and responsible for signal an impairment. Words like facilitate, coach, advise, coordinate, consolidate, recommend, evaluate, and assess signal acceptable roles.
Tip 2 - Know the fan diagram cold. Many questions present a list of activities and ask which one internal audit should never perform. The six prohibited roles are: setting risk appetite, imposing risk processes, providing management assurance on risks, deciding risk responses, implementing risk responses, and being accountable for risk management. If one of these appears, it is almost certainly the answer.
Tip 3 - Distinguish assurance from consulting. Consulting engagements allow far more involvement in risk management, provided management retains decisions. Assurance engagements require strict independence. If the scenario says the engagement is advisory and management will make the decisions, the activity is usually acceptable.
Tip 4 - Remember the one-year rule. Objectivity is presumed impaired if an auditor provides assurance over an area for which they had operational responsibility within the past year. If a question involves a recently transferred employee or an auditor who built a risk process, the correct answer typically assigns a different auditor or defers the audit.
Tip 5 - When the CAE wears two hats, think 'board approval plus independent oversight.' The best answer for CAE-as-CRO scenarios combines board approval, charter documentation, disclosure, and assurance over the risk function being provided by someone outside internal audit (such as an external provider or another independent party).
Tip 6 - Disclosure is required, not optional. If an impairment exists in fact or appearance, the Standards require disclosure to appropriate parties. Answers that suggest ignoring, hiding, or simply accepting an impairment without disclosure are wrong. Answers that suggest disclosure to the board and the engagement client are strong.
Tip 7 - 'Appearance' counts as much as 'fact.' Even when the auditor believes they can remain objective, a reasonable third party's perception matters. Eliminate answers that rely on the auditor's personal confidence in their own objectivity.
Tip 8 - Favor answers that preserve management ownership. When asked how internal audit can help an organization with immature ERM, the best answer lets internal audit champion, facilitate, and develop a framework for board approval while management owns the risks and responses. Avoid answers where internal audit 'takes charge until management is ready' without safeguards.
Tip 9 - Watch for the 'most appropriate' wording. Several options may be partially correct. The most appropriate answer generally involves the board or audit committee, documents the arrangement, and limits the duration. A purely informal or verbal arrangement is rarely the best answer.
Tip 10 - Connect to the Three Lines Model. If a question references the Three Lines Model, remember that internal audit is the third line and should not perform first-line (owning risk) or second-line (monitoring and challenging as part of management) functions without the governing body being informed and safeguards in place.
Tip 11 - Scope and access restrictions are also impairments. Not every impairment comes from a role conflict. If management restricts scope, limits access to records or personnel, or pressures the auditor to alter findings, that is an impairment that must be reported to the board.
Tip 12 - Eliminate extreme answers. Options stating internal audit may 'never' be involved in ERM or may 'always' lead ERM are usually wrong. The Standards and Position Paper allow involvement with safeguards; the exam rewards nuanced, judgment-based answers.
Quick Recall Summary
- Internal audit's primary role in ERM is to evaluate and give assurance on risk management processes.
- Internal audit may facilitate, coach, coordinate, consolidate, and champion with safeguards.
- Internal audit must never set risk appetite, decide or implement responses, impose processes, give management assurance, or be accountable for risk management.
- Impairments in fact or appearance must be disclosed.
- No assurance over areas of prior responsibility within one year.
- CAE additional roles require board approval, charter documentation, safeguards, and independent assurance.
Master these principles and practice applying the ownership test to scenario-based questions, and you will handle every impairment question the CRMA exam presents.
Test mode:
Unlock Premium Access
Certification in Risk Management Assurance
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3053 Superior-grade Certification in Risk Management Assurance practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CRMA: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Impairments from Risk Management Responsibilities questions
17 questions (total)
Other Internal Audit Roles and Responsibilities concepts
Advisory and Consulting Services on Risk ManagementAdvocating for Enterprise Risk ManagementAssessing Internal Audit Skill GapsAssurance Services on Risk ManagementBuilding an Organizationwide Risk Assurance MapChief Audit Executive Roles Beyond Internal AuditingChoosing Assurance or Advisory for a Risk RequestCombined AssuranceCompetencies for Risk Management AssuranceCoordinating Assurance Across ProvidersCore Internal Audit Roles in Enterprise Risk ManagementCo-Sourcing and Outsourcing Risk ExpertiseDeclining or Adjusting Work That Lacks CompetenceDeveloping Risk Management Competence in StaffEvaluating Reliance on Other Assurance ProvidersFinding Gaps and Overlaps with an Assurance MapFunctional and Administrative Reporting LinesImproving Existing Risk Management ProcessesInternal Audit ERM Roles That Need SafeguardsInternal Audit's Role When No Risk Process ExistsMaintaining and Updating the Assurance MapOrganizational Independence of Internal AuditRecommending an Organizationwide Risk StrategyRelying on External Auditors and RegulatorsReporting Impairments to the Board and ManagementRoles Internal Audit Should Not Take in ERMSafeguards When Internal Audit Leads Risk WorkThe Three Lines ModelUsing External Experts in Risk Engagements