Improving Existing Risk Management Processes

Overview
Within the IIA Certification in Risk Management Assurance (CRMA) syllabus, the domain on Internal Audit Roles and Responsibilities examines how internal audit contributes to an organization's risk management framework. One of the most frequently tested topics is improving existing risk management processes: the legitimate consulting and advisory activities internal audit can perform to help management strengthen a risk management framework that already exists, without compromising its independence and objectivity. This guide explains why the topic matters, what it covers, how it works in practice, and how to tackle exam questions about it.

1. Why This Topic Is Important
Risk management is rarely implemented perfectly the first time. Organizations typically start with a basic framework (a risk register, an annual risk assessment, some reporting to the board) and then mature over time. Internal audit sits in a unique position: it sees risks and controls across the entire organization, understands the governance framework, and reports to the board or audit committee. This makes it a natural catalyst for improvement.

However, the same qualities that make internal audit valuable also create a danger. If internal audit takes ownership of risk management, it can no longer provide objective assurance over it. The IIA therefore draws a careful line between:
- Core assurance roles (what internal audit should do),
- Legitimate consulting roles with safeguards (what internal audit may do), and
- Roles internal audit should not undertake (what internal audit must avoid).

Improving existing risk management processes sits firmly in the second category. For the exam, you must know exactly where the boundaries lie and what safeguards make these activities acceptable. Questions in this area test your judgment about independence, objectivity, management ownership, and board oversight, which are central themes across the entire CRMA exam.

The topic is also important from a practical standpoint. The IIA Global Internal Audit Standards and the Three Lines Model both recognize that internal audit adds value not only by reporting findings but by helping the organization become better at managing risk. An internal audit function that only points out problems without helping the organization build capability is seen as less effective and less relevant to stakeholders.

2. What It Is
Improving existing risk management processes refers to the advisory, facilitative, and consulting activities internal audit performs to enhance a risk management framework that management has already established. The key word is existing: management owns the process, has designed and implemented it, and internal audit is helping to make it better.

According to the IIA's guidance on the role of internal auditing in enterprise-wide risk management, the legitimate roles with safeguards include:
- Facilitating identification and evaluation of risks,
- Coaching management in responding to risks,
- Coordinating ERM activities,
- Consolidating the reporting on risks,
- Maintaining and developing the ERM framework,
- Championing the establishment of ERM, and
- Developing a risk management strategy for board approval.

These activities contrast with the core assurance roles:
- Giving assurance on risk management processes,
- Giving assurance that risks are correctly evaluated,
- Evaluating risk management processes,
- Evaluating the reporting of key risks, and
- Reviewing the management of key risks.

And with the roles internal audit should not undertake:
- Setting the risk appetite,
- Imposing risk management processes,
- Providing management assurance on risks (i.e., acting as the sole source of assurance that management relies upon),
- Making decisions on risk responses,
- Implementing risk responses on management's behalf, and
- Being accountable for risk management.

Improving existing processes draws on the middle category. Internal audit may recommend, advise, facilitate, benchmark, train, and coach. It may not decide, own, implement, or be accountable.

Typical areas where internal audit helps improve risk management
- Risk identification: helping management broaden its view to include emerging risks, strategic risks, third-party risks, and cross-functional risks that siloed business units may miss.
- Risk assessment methodology: advising on consistent scoring scales, likelihood and impact criteria, velocity and persistence, and the distinction between inherent and residual risk.
- Risk appetite and tolerance: facilitating discussions and providing frameworks, while the board and senior management make the actual decisions.
- Key risk indicators (KRIs): advising on selection of leading indicators, thresholds, and escalation triggers.
- Risk reporting: recommending improvements to dashboards, heat maps, and board reporting so that risk information is timely, relevant, and decision-useful.
- Risk culture: highlighting cultural weaknesses observed during audit work and recommending ways to embed risk awareness.
- Integration with strategy and performance: encouraging alignment with frameworks such as COSO ERM 2017 (Enterprise Risk Management: Integrating with Strategy and Performance) and ISO 31000:2018.
- Risk ownership and accountability: recommending clearer assignment of risk owners and action plans.
- Process maturity: assessing where the organization sits on a maturity model and recommending a realistic roadmap to the next level.

3. How It Works
In practice, internal audit's contribution to improving risk management processes follows a logical sequence.

Step 1: Understand the current state. Internal audit reviews the existing framework: policies, risk registers, assessment methodologies, reporting lines, committee charters, and the roles of the first and second lines. It often uses a risk management maturity model (for example, levels from risk naive through risk aware, risk defined, risk managed, to risk enabled) to describe the starting point. The IIA's own Risk Maturity Model and the COSO ERM framework principles are common reference points.

Step 2: Benchmark against good practice. The current state is compared with recognized frameworks (COSO ERM 2017, ISO 31000:2018, sector regulations) and with peer organizations. Gaps are identified, such as absence of a formal risk appetite statement, inconsistent scoring, no emerging risk process, or weak linkage between risk and strategy.

Step 3: Agree the scope of the engagement. Because this is a consulting engagement, the nature, scope, and expected outcomes are agreed with management (the engagement client). The chief audit executive (CAE) ensures the engagement is consistent with the internal audit charter and that the audit committee is aware. If the engagement could impair future assurance work, this must be disclosed.

Step 4: Facilitate and advise. Internal audit may run risk workshops, train risk owners, provide templates and tools, coach management in developing responses, help design KRIs, and draft proposed enhancements to the framework. The style is collaborative, but the outputs are recommendations, not decisions.

Step 5: Management decides and implements. Management evaluates the recommendations, decides which to adopt, assigns resources, and implements changes. The board or risk committee approves significant changes such as the risk appetite statement or the ERM strategy. Internal audit does not implement.

Step 6: Communicate and follow up. Internal audit reports results of the consulting engagement to the engagement client and, where significant governance or risk issues arise, to senior management and the board. Later, internal audit may follow up on whether agreed improvements were implemented.

Step 7: Apply safeguards throughout. The safeguards that keep these activities legitimate include:
- It should be clear that management remains responsible for risk management.
- The nature of internal audit's responsibilities should be documented in the internal audit charter and approved by the audit committee.
- Internal audit should not manage any of the risks on behalf of management.
- Internal audit should provide advice, challenge, and support to management's decision-making, as opposed to taking risk management decisions itself.
- Internal audit cannot give objective assurance on any part of the ERM framework for which it is responsible; such assurance should be provided by other suitably qualified parties.
- Any work beyond assurance should be recognized as a consulting engagement, and the implementation standards related to such engagements should be followed.
- Where auditors have been involved in designing or improving a process, they should not audit that process for a reasonable period (commonly at least one year) to avoid self-review threats.

The Three Lines Model connection. The IIA's Three Lines Model (2020) positions management (first and second line roles) as responsible for managing risk and internal audit (third line) as providing independent assurance and advice. The model explicitly allows internal audit to offer advice and insight while remaining independent of management responsibilities. Improving existing risk management processes is exactly this advisory role, and the model stresses that the governing body must be informed and that independence must be preserved.

4. Why Internal Audit Is Well Placed to Help
- Enterprise-wide visibility across all functions and risks.
- Deep knowledge of governance, risk, and control frameworks.
- Direct reporting line to the board or audit committee, giving credibility and influence.
- Skills in facilitation, root-cause analysis, and process evaluation.
- Access to benchmarking information and professional guidance.

However, if the organization has a mature second-line risk function (such as a Chief Risk Officer), internal audit's improvement role should be lighter and more focused on assurance, leaving design and coordination to the second line. In less mature organizations, internal audit may play a more active catalytic role, with heavier safeguards.

5. How to Answer Exam Questions on This Topic
CRMA questions on improving existing risk management processes are usually scenario-based. You are given a situation and asked what internal audit should do, what is most appropriate, or which action would impair independence. Use the following approach.

Step A: Classify the activity. Ask yourself: is the activity described a core assurance role, a legitimate consulting role with safeguards, or a prohibited role? If the scenario involves setting risk appetite, deciding on risk responses, implementing controls, or taking accountability for risk management, that is prohibited. If it involves facilitating, advising, recommending, coaching, or coordinating, it is legitimate provided safeguards exist.

Step B: Look for ownership language. The correct answer almost always preserves management ownership of risk management and board approval of key decisions. Answers in which internal audit decides, approves, implements, or owns are typically wrong.

Step C: Check the safeguards. If the question asks how internal audit can perform an improvement role without impairing independence, look for answers mentioning: documenting the role in the charter, audit committee approval, disclosure of impairments, management retaining responsibility, treating the work as a consulting engagement, and avoiding auditing one's own work for a period.

Step D: Prefer frameworks and maturity. When asked about the best way to identify improvement opportunities, answers that reference recognized frameworks (COSO ERM, ISO 31000), maturity models, benchmarking, and root-cause analysis are usually stronger than answers based on individual opinion or ad hoc observation.

Step E: Eliminate extremes. Options stating that internal audit should never be involved in risk management improvement, or that internal audit should take over the risk function, are usually distractors. The IIA position is balanced: involvement is appropriate with safeguards.

Step F: Consider the organization's maturity. If the scenario describes a mature ERM function with a CRO, internal audit should focus on assurance and limit advisory involvement. If the scenario describes an immature or non-existent framework, a more active championing or facilitating role is acceptable, again with safeguards.

Worked example. A question describes an organization whose risk register has not been updated in two years and whose risk scoring is inconsistent across departments. Management asks internal audit to help. Which action is most appropriate? Options might be: (a) internal audit updates the risk register and assigns new scores; (b) internal audit facilitates workshops where risk owners reassess risks using a consistent methodology recommended by internal audit and approved by management; (c) internal audit declines because this would impair independence; (d) internal audit sets the risk tolerance levels for each department. The best answer is (b): it is facilitative, management owns the outcome, and the methodology is approved by management. Option (a) has internal audit performing management's job, (c) is an unnecessary extreme, and (d) is a prohibited role.

Exam Tips: Answering Questions on Improving Existing Risk Management Processes
- Memorize the three categories from the IIA position paper on ERM: core assurance roles, legitimate roles with safeguards, and roles internal audit should not undertake. Many questions are simply testing whether you can place an activity in the right category.
- Watch for verbs. Facilitate, coach, advise, recommend, coordinate, consolidate, champion, and develop (for board approval) are legitimate. Set, decide, impose, implement, own, and be accountable are prohibited.
- Safeguards are the key to many answers. If asked how internal audit can take on a consulting role safely, select the answer that mentions management ownership, charter documentation, audit committee approval, and separation from subsequent assurance.
- Independence impairments must be disclosed. If an auditor who helped design improvements is later asked to audit them, the correct answer is to disclose the impairment and typically assign a different auditor or defer the audit.
- Board approval for strategic items. Risk appetite statements and ERM strategy are approved by the board or governing body, not by internal audit, even when internal audit helped draft them.
- Frameworks matter. Know the basics of COSO ERM 2017 (five components: Governance and Culture; Strategy and Objective-Setting; Performance; Review and Revision; Information, Communication, and Reporting) and ISO 31000:2018 (principles, framework, process). Questions may ask which framework element an improvement relates to.
- Maturity models signal the right level of involvement. Low maturity allows more active internal audit involvement with strong safeguards; high maturity calls for internal audit to step back toward assurance.
- Consulting engagement rules apply. Remember that improvement work is a consulting engagement: agree scope with the client, apply due professional care, communicate results appropriately, and escalate significant governance or control issues to senior management and the board.
- Do not confuse recommending with implementing. An internal auditor who recommends a new KRI dashboard is acting appropriately; one who builds, maintains, and monitors it on an ongoing basis has crossed into management.
- Read the question stem carefully for words like most appropriate, least likely to impair, or should not. These change which option is correct.
- When in doubt, choose balance. The IIA favors internal audit adding value through advice while preserving independence. Options that reflect this balance are usually correct over absolute positions.

Summary
Improving existing risk management processes is a legitimate and valuable role for internal audit, provided it is performed as a consulting activity with appropriate safeguards. Internal audit may facilitate, advise, coach, benchmark, and recommend; it may not set risk appetite, make risk decisions, implement responses, or take accountability. Management owns risk management, the board approves key elements, and the audit committee oversees internal audit's involvement through the charter. In the CRMA exam, success on this topic comes from classifying activities correctly, recognizing the safeguards, respecting ownership boundaries, and selecting balanced answers grounded in IIA guidance and recognized frameworks.