Roles Internal Audit Should Not Take in ERM

Why This Topic Matters

Enterprise Risk Management (ERM) is one of the most valuable areas where internal audit can add value, but it is also one of the most dangerous for independence and objectivity. The IIA's Certification in Risk Management Assurance (CRMA) exam places heavy emphasis on the boundary between what internal audit may do in ERM and what it must never do. If internal audit crosses this line, it ends up auditing its own work, management loses accountability for risk, and the board loses the independent assurance it depends on. Exam questions in this area test whether you truly understand the principle of independence rather than just memorising a list.

What It Is: The IIA Position on Internal Audit's Role in ERM

The IIA's position paper, The Role of Internal Auditing in Enterprise-wide Risk Management, uses the famous "fan" diagram, which divides activities into three zones:

1. Core internal audit roles in ERM (assurance activities) – e.g., giving assurance on risk management processes, giving assurance that risks are correctly evaluated, evaluating risk management processes, evaluating the reporting of key risks, and reviewing the management of key risks.

2. Legitimate internal audit roles with safeguards (consulting activities) – e.g., facilitating identification and evaluation of risks, coaching management in responding to risks, coordinating ERM activities, consolidating risk reporting, maintaining and developing the ERM framework, championing establishment of ERM, and developing an ERM strategy for board approval.

3. Roles internal audit should NOT undertake – the prohibited zone. These are management responsibilities, and taking them on would compromise independence and objectivity.

The Prohibited Roles (Memorise These)

According to the IIA, internal audit should not:

• Set the risk appetite – deciding how much risk the organisation is willing to accept is a board and senior management decision.
• Impose risk management processes – internal audit may recommend or facilitate, but cannot mandate processes on management.
• Provide management assurance on risks – internal audit gives independent assurance to the board; it cannot act as management's own guarantor that risks are controlled.
• Take decisions on risk responses – choosing whether to accept, avoid, transfer or mitigate a risk is management's call.
• Implement risk responses on management's behalf – internal audit cannot execute the controls or actions chosen to address risks.
• Be accountable for risk management – ownership and accountability for risk management must remain with management; internal audit cannot be the "owner" of ERM.

A helpful mnemonic: "SIP-DIA" – Set appetite, Impose processes, Provide management assurance, Decide responses, Implement responses, Accountability.

How It Works: The Underlying Logic

The dividing line is the concept of management responsibility. The IIA Standards (including Standard 1100 on Independence and Objectivity, Standard 1130 on Impairment, and Standard 2120 on Risk Management) make clear that internal audit must remain free from responsibility for the activities it audits. The interpretation of Standard 2120 explicitly states that internal audit must refrain from assuming any management responsibility by actually managing risks.

Three principles explain why each prohibited role is off limits:

1. Ownership – Management owns risk. If internal audit sets appetite or decides responses, management can deflect blame ("audit told us to do it"), and accountability becomes blurred.

2. Self-review threat – If internal audit implements a risk response or runs the ERM process, it cannot later objectively audit that process. The Standards require that anyone who performed an activity must not provide assurance on it for at least one year.

3. Three Lines Model – In the IIA's Three Lines Model, management (first and second lines) owns and manages risk, while internal audit (third line) provides independent assurance. Prohibited roles would collapse internal audit into the first or second line.

Safeguards When Operating in the Middle Zone

Exam questions often blur the middle (legitimate with safeguards) and prohibited zones. Remember that consulting roles are acceptable only if:
• It is clear that management remains responsible for risk management.
• The nature of internal audit's responsibilities is documented in the internal audit charter.
• Internal audit does not manage any risks on behalf of management.
• Internal audit provides advice, challenge and support to management's decision-making, rather than making the decisions itself.
• Any work that compromises independence is disclosed to the board, and assurance on that area is sourced elsewhere.
• The arrangement is ideally temporary, with a plan to transition responsibilities to management.

Common Scenario Patterns

• A small organisation with no risk function asks the CAE to "run" risk management. Answer: The CAE may champion and help develop the framework temporarily with board approval and disclosure, but cannot be accountable for risk management or make risk decisions.
• The CEO asks internal audit to decide which risks to accept. Answer: Prohibited – deciding risk responses is management's role.
• The board asks internal audit to recommend a risk appetite. Answer: Internal audit may facilitate the discussion and give input, but setting the appetite is the board's decision.
• Internal audit develops the ERM strategy for board approval. Answer: Legitimate with safeguards (the board approves; internal audit does not own it).
• Internal audit is asked to implement a new control to address a cyber risk. Answer: Prohibited – implementing risk responses is a management responsibility.

Exam Tips: Answering Questions on Roles Internal Audit Should Not Take in ERM

1. Ask the ownership question first. For any scenario, ask: "Would this make internal audit responsible for managing a risk or making a management decision?" If yes, it is prohibited.

2. Watch for decision verbs. Words like set, decide, impose, implement, own, approve and be accountable signal prohibited roles. Words like facilitate, coach, coordinate, champion, advise and evaluate signal acceptable roles.

3. Distinguish "develop" from "decide". Internal audit may develop an ERM strategy or framework for board approval (acceptable with safeguards), but may not set the risk appetite or impose the process (prohibited). The difference is who makes the final decision.

4. Distinguish assurance to the board from assurance to management. Internal audit provides independent assurance to the board and audit committee. It cannot be management's guarantee that risks are managed – that is management's own job.

5. Beware of "small organisation" distractors. Resource constraints never justify internal audit taking on prohibited roles. They may justify temporary consulting roles with safeguards and disclosure, but never ownership or decision-making.

6. Remember the one-year rule. If internal audit does take on consulting work in an area, it should not provide assurance on that area for at least a year, and alternative assurance should be arranged.

7. Know the Standards references. Standard 2120 (Risk Management) and its interpretation, Standard 1130 (Impairment to Independence or Objectivity), and the IIA position paper on ERM are the authoritative sources. Questions may ask which standard is relevant.

8. In "BEST response" questions, choose the option that preserves independence while still adding value. The IIA favours answers where internal audit supports management (facilitates, advises, recommends) but management retains accountability and the final say.

9. Eliminate extremes. Options stating internal audit should have "no involvement" in ERM are usually wrong, since assurance roles are core. Options where internal audit "manages" or "owns" ERM are also wrong. The correct answer usually lies in appropriate involvement with clear boundaries.

10. Link to the Three Lines Model. If a scenario places internal audit in a first- or second-line role (owning or managing risk), it is a red flag. Internal audit belongs in the third line.

Key Takeaway

Internal audit can be a powerful contributor to ERM, but it must never become the owner of risk. The six prohibited roles – setting risk appetite, imposing processes, providing management assurance, deciding responses, implementing responses, and being accountable for risk management – all share one feature: they transfer management responsibility to internal audit. Keep that principle at the centre of your thinking and the exam questions become far easier to answer.