Internal Audit ERM Roles That Need Safeguards

1. Why This Topic Matters

Enterprise Risk Management (ERM) is one of the areas where internal audit adds the most value and faces the most danger. The value comes from internal audit's cross-organizational view, its risk expertise, and its direct line to the board. The danger comes from a simple fact: if internal audit helps build or run the risk management process, it can no longer give independent, objective assurance on that same process.

The IIA addressed this tension in its position paper The Role of Internal Auditing in Enterprise-wide Risk Management, which introduced the well-known 'fan' diagram. The fan divides ERM activities into three zones: (1) core assurance roles internal audit should perform, (2) legitimate consulting roles internal audit may perform only with safeguards, and (3) roles internal audit should never undertake. The middle zone is the focus of this concept and is heavily tested on the CRMA exam because it requires judgment rather than memorization alone.

Understanding this topic protects three things: the independence of the internal audit function (an organizational attribute), the objectivity of individual auditors (a mental attitude), and the credibility of assurance relied upon by the board and audit committee. If any of these is compromised, the board may be unknowingly relying on assurance from the very people who designed the controls being assessed.

2. What It Is: The Three Zones of the Fan

Zone 1 - Core internal audit roles (assurance, no safeguards needed):
- Giving assurance on risk management processes
- Giving assurance that risks are correctly evaluated
- Evaluating risk management processes
- Evaluating the reporting of key risks
- Reviewing the management of key risks

These are pure assurance activities. They fit directly under the mandate to evaluate the effectiveness of risk management and do not threaten independence.

Zone 2 - Legitimate roles WITH safeguards (consulting):
- Facilitating the identification and evaluation of risks
- Coaching management in responding to risks
- Coordinating ERM activities
- Consolidating the reporting on risks
- Maintaining and developing the ERM framework
- Championing the establishment of ERM
- Developing a risk management strategy for board approval

These are consulting activities. Notice the verbs: facilitating, coaching, coordinating, consolidating, maintaining, championing, developing for approval. In every case internal audit is helping, advising, or doing administrative work, but management still owns the decisions and the risks. The further you move toward the right side of the fan (championing, developing strategy), the greater the threat to objectivity and the stronger the safeguards must be.

Zone 3 - Roles internal audit should NOT undertake:
- Setting the risk appetite
- Imposing risk management processes
- Providing management assurance on risks (i.e., acting as management's own assurance)
- Taking decisions on risk responses
- Implementing risk responses on management's behalf
- Accountability for risk management

These are management responsibilities. The verbs here are decisive and ownership-based: setting, imposing, deciding, implementing, being accountable. No safeguard can make these acceptable because they place internal audit in the position of management, which it would then have to audit.

3. How It Works: The Safeguards Themselves

When internal audit takes on a Zone 2 role, the IIA position paper specifies the safeguards that must be in place. Memorize these - they are the heart of exam questions on this topic:

Safeguard 1 - Management remains responsible. It must be clear, in substance and in documentation, that management (the first and second lines) remains responsible for risk management. Internal audit helps; it does not own.

Safeguard 2 - Charter approval. The nature of internal audit's ERM responsibilities should be documented in the internal audit charter and approved by the audit committee (or board). This creates transparency and gives the board the chance to object before the role is taken on.

Safeguard 3 - No managing of risks. Internal audit should not manage any of the risks on behalf of management. Facilitating a risk workshop is fine; deciding which risks to accept is not.

Safeguard 4 - Advice, challenge and support only. Internal audit should provide advice, challenge, and support to management's decision making, as opposed to taking risk management decisions itself. The auditor can say 'Have you considered X?' but not 'We will do X.'

Safeguard 5 - No self-assurance. Internal audit cannot give objective assurance on any part of the ERM framework for which it is responsible. If internal audit maintains the risk register, assurance on the risk register must come from another suitably qualified party (e.g., an external provider, a co-source partner, or a separate team with appropriate independence). This is the safeguard most often tested.

Safeguard 6 - Treat it as consulting. Any work beyond assurance activities should be recognized as a consulting engagement, and the standards governing consulting engagements must be followed - including agreeing objectives and scope with the engagement client, addressing risk and control issues consistent with the organization's objectives, and disclosing potential impairments before accepting the engagement.

4. Supporting Standards and Frameworks

The safeguards link directly to the Standards. Under the 2017 International Standards for the Professional Practice of Internal Auditing, Standard 1100 requires the activity to be independent and auditors to be objective; Standard 1130 requires disclosure of impairments; Standard 1130.A1 states auditors must refrain from assessing operations for which they were previously responsible, with objectivity presumed impaired if assurance is provided over an activity for which the auditor had responsibility within the previous year; Standard 1130.C1 permits consulting on operations previously managed; Standard 1130.C2 requires disclosure of potential impairments before accepting a consulting engagement; and Standard 2120 (with 2120.C1-C3) requires internal audit to evaluate risk management, address risk during consulting work, and - critically - states that when assisting management in establishing or improving risk management processes, internal auditors must refrain from assuming any management responsibility by actually managing risks.

The Global Internal Audit Standards (effective 2025) carry the same logic forward under Principle 2 (Maintain Objectivity), including Standard 2.2 on safeguarding objectivity and the one-year cooling-off expectation, Standard 2.3 on disclosing impairments, and Principle 7 (Positioned Independently), which requires the board to approve the charter and any non-audit responsibilities assigned to the chief audit executive, together with safeguards to address them.

The IIA Three Lines Model reinforces this: the first line owns and manages risk, the second line provides expertise and monitoring (this is where ERM functions normally sit), and the third line - internal audit - provides independent assurance. When internal audit takes a Zone 2 role, it is temporarily stepping into second-line territory, and safeguards exist precisely to manage that overlap.

5. Practical Illustration

Suppose an organization has no ERM function and asks the CAE to help get one started. Acceptable with safeguards: the CAE facilitates workshops to identify risks, drafts a framework for management's review, champions ERM with the executive team, and coordinates the first consolidated risk report. Required safeguards: the audit committee approves these roles in the charter; management is clearly named as owner of the framework; the CAE provides options rather than decisions; the work is scoped as consulting; and assurance on the framework's design is outsourced to an external party for the period in which internal audit is involved. Unacceptable regardless of safeguards: the CAE deciding the organization's risk appetite, selecting risk responses, or being held accountable if a key risk materializes. The ideal end state is that internal audit transitions out of the second-line role as management builds capability, returning to full assurance.

6. Exam Tips: Answering Questions on Internal Audit ERM Roles That Need Safeguards

Tip 1 - Classify by verb. When a scenario describes an activity, isolate the verb. Assure, evaluate, review = core role. Facilitate, coach, coordinate, consolidate, maintain, champion, develop (for approval) = legitimate with safeguards. Set, impose, decide, implement, be accountable = prohibited. This single technique answers most classification questions.

Tip 2 - Watch for 'on behalf of management' and 'for board approval'. 'Implementing risk responses on behalf of management' is prohibited. 'Developing a risk management strategy for board approval' is permitted with safeguards. The phrase tells you who retains the decision.

Tip 3 - Know the safeguards list cold. Expect questions asking which safeguard applies, or which option is NOT a recognized safeguard. Distractors often include things like 'rotating the CAE every three years' or 'obtaining management's verbal agreement' - these are not the IIA safeguards. The real ones involve charter documentation, audit committee approval, management ownership, advice-not-decisions, no self-assurance, and treating the work as consulting.

Tip 4 - The 'who provides assurance' trap. If internal audit maintains the ERM framework, the correct answer to 'who should provide assurance on it?' is another suitably qualified, independent party - never internal audit itself, and never management.

Tip 5 - Remember the one-year rule. If an auditor had operational responsibility for a risk management activity within the past year, objectivity is presumed impaired for assurance on that activity. Consulting on the same activity is permitted, but any impairment must be disclosed beforehand.

Tip 6 - 'Best' answers favor independence and the board. When two options both seem reasonable, the CRMA exam prefers the one that (a) keeps decision authority with management, (b) involves the audit committee or board in approving the role, and (c) preserves internal audit's ability to give future assurance. Options that have internal audit 'taking charge' to be helpful are almost always wrong.

Tip 7 - Risk appetite is management's and the board's. Any option in which internal audit sets, defines, or determines risk appetite or tolerance is prohibited. Internal audit may evaluate whether risk appetite has been set and communicated, and may facilitate discussion, but never sets it.

Tip 8 - Scenario-based questions test the transition. If the question describes internal audit having helped build ERM in an immature organization, the best answer often involves a plan to transfer the role to management over time while maintaining safeguards in the interim.

Tip 9 - Do not confuse impairment with prohibition. Zone 2 roles create a potential impairment that safeguards can manage. Zone 3 roles create an actual assumption of management responsibility that safeguards cannot cure. Questions may ask you to distinguish the two.

7. Quick Recap

Core roles = assurance, always fine. Safeguarded roles = consulting-style help where management keeps ownership; permitted only if documented in the charter, approved by the audit committee, limited to advice and support, free of self-assurance, and treated as consulting. Prohibited roles = anything that makes internal audit the owner, decider, or implementer of risk management. Master the fan diagram, the verbs, and the six safeguards, and you will handle any CRMA question in this area with confidence.