Safeguards When Internal Audit Leads Risk Work

Why This Topic Matters

In many organisations, especially smaller ones or those with immature risk management, the internal audit function is asked to do far more than simply give assurance over risk management. The chief audit executive (CAE) may be asked to champion the adoption of enterprise risk management (ERM), facilitate risk workshops, consolidate risk reporting for the board, or even act as the de facto risk manager. This creates a fundamental tension: internal audit's value rests on independence and objectivity, yet leading risk work pulls the function toward ownership of the very processes it is later expected to assess.

The CRMA exam tests this topic heavily because it sits at the intersection of the IIA's Global Internal Audit Standards (independence, objectivity, and conflicts of interest), the Three Lines Model (clear separation between management and independent assurance), and the IIA Position Paper The Role of Internal Auditing in Enterprise-wide Risk Management. Candidates must be able to distinguish between roles internal audit should perform, roles it may perform only if safeguards exist, and roles it must never perform. Getting this wrong in practice can compromise the audit function's credibility with the board; getting it wrong in the exam costs easy marks.

What It Is: The Concept Defined

Safeguards when internal audit leads risk work are the structural, governance, and procedural controls put in place so that internal audit can legitimately contribute to building or running risk management activities without undermining its ability to provide objective assurance. They exist to protect three things:

1. Management ownership of risks and risk responses.
2. Internal audit's objectivity when it later assesses risk management.
3. The board's confidence that assurance it receives is independent.

The IIA position paper uses a well-known fan-shaped diagram that divides ERM-related activities into three zones:

Zone 1 - Core internal audit assurance roles (always appropriate):
- Giving assurance on the risk management processes.
- Giving assurance that risks are correctly evaluated.
- Evaluating risk management processes.
- Evaluating the reporting of key risks.
- Reviewing the management of key risks.

Zone 2 - Legitimate internal audit roles with safeguards (consulting activities that are acceptable only when protected):
- Facilitating the identification and evaluation of risks.
- Coaching management in responding to risks.
- Coordinating ERM activities.
- Consolidating the reporting on risks.
- Maintaining and developing the ERM framework.
- Championing the establishment of ERM.
- Developing a risk management strategy for board approval.

Zone 3 - Roles internal audit should NOT undertake (never appropriate):
- Setting the risk appetite.
- Imposing risk management processes.
- Providing management assurance on risks.
- Taking decisions on risk responses.
- Implementing risk responses on management's behalf.
- Having accountability for risk management.

The safeguards topic lives in Zone 2. The key insight is that the same activity can be acceptable or unacceptable depending on whether safeguards are in place and whether internal audit crosses from advising into deciding.

How It Works: The Safeguards in Detail

The IIA position paper and the Global Internal Audit Standards identify a consistent set of safeguards. Learn them as a list, because exam questions frequently ask which one is most appropriate in a given scenario.

1. Management retains responsibility. It must be clear, and documented, that management remains responsible for risk management. Internal audit advises, challenges, and supports management's decision-making; it does not make the decisions. If a risk workshop produces a list of risks, management, not the auditor, decides which responses to adopt.

2. The nature of internal audit's responsibilities is documented in the internal audit charter and approved by the board. Any expanded role in risk management must be explicitly described in the charter. Board (audit committee) approval is the single most powerful governance safeguard because it ensures the people relying on assurance knowingly accept the trade-off. Under the Global Internal Audit Standards, when the CAE is assigned roles beyond internal auditing, the board must approve this and establish safeguards.

3. Internal audit should not manage any risks on behalf of management. Coordinating, facilitating, and reporting are fine; owning a risk register as the accountable party, deciding mitigation, or running the control is not.

4. Internal audit cannot provide objective assurance over any part of the ERM framework for which it is responsible. Where internal audit has built or operates part of the framework, assurance over that part must be obtained from another suitably qualified party, such as an external provider, a separate second-line function, or a co-sourced team. The Standards reinforce this: auditors should not assess operations for which they held responsibility within the previous year, and the CAE's non-audit responsibilities should be independently assessed by someone outside the function.

5. Treat the work as a consulting engagement. Any work beyond assurance is a consulting engagement, and the relevant standards for consulting apply: agree the objectives and scope with the client, communicate that it is advisory, and avoid assuming management responsibility. This includes being transparent with the board about which activities are consulting and which are assurance.

6. Time-limit and transition plan. A common safeguard is that internal audit's leadership of risk work is temporary, for example championing ERM only until a risk function is established, with a documented exit plan transferring ownership to management.

7. Separate reporting lines and disclosure of impairments. Where the CAE also holds a risk management role, the CAE should report functionally to the board for audit matters, disclose the dual role, and the board should periodically evaluate whether the arrangement still works. Any actual or perceived impairment to objectivity must be disclosed to the board.

8. Rotation and staffing safeguards. Assign different auditors to facilitation work versus later assurance work on the same area; apply cooling-off periods; and supervise engagements to spot objectivity threats.

Linking to the Three Lines Model

The 2020 Three Lines Model describes management (first and second line roles, including risk management functions) and internal audit (third line) as distinct. Internal audit may offer advice and insight, but its defining feature is independence from management responsibilities. When internal audit leads risk work it is temporarily performing a second-line role, so safeguards are what keep the model intact: the board must know, management must own, and independent assurance over that work must come from elsewhere.

Worked Scenarios

Scenario A: The CEO asks the CAE to facilitate risk assessment workshops across all business units because no risk function exists. Analysis: Zone 2, acceptable. Safeguards: document in the charter, obtain board approval, ensure business unit managers own the identified risks and responses, record it as consulting, and plan to transfer facilitation to a future risk function.

Scenario B: The board asks the CAE to set the organisation's risk appetite because the CAE understands risk best. Analysis: Zone 3, not acceptable. Setting risk appetite is a board and executive management responsibility. The CAE may provide input, benchmarks, and facilitation, but may not set it.

Scenario C: Internal audit designed and now maintains the ERM framework; the audit committee asks internal audit for assurance that the framework is effective. Analysis: Internal audit cannot give objective assurance on work it owns. The safeguard is independent assurance from an external or other qualified party, and the audit committee should be told why.

Scenario D: An auditor who ran the ERM coordination role last year is scheduled to audit risk management this year. Analysis: Objectivity impairment. Apply the cooling-off safeguard or reassign to a different auditor, and disclose if unavoidable.

Exam Tips: Answering Questions on Safeguards When Internal Audit Leads Risk Work

Tip 1 - Classify first, then choose. For every scenario, decide which of the three zones the activity sits in. If it is Zone 3, the correct answer usually states that internal audit should decline or that the role belongs to management or the board. If it is Zone 2, the correct answer usually describes a safeguard.

Tip 2 - Watch for ownership verbs. Words such as decide, approve, implement, own, set, be accountable for, manage signal prohibited roles. Words such as facilitate, coach, coordinate, consolidate, champion, advise, support signal consulting roles that are acceptable with safeguards.

Tip 3 - The board is the anchor. When asked for the most important or first safeguard, answers involving board (audit committee) approval and documentation in the charter are usually correct. The board must knowingly accept the arrangement.

Tip 4 - Management keeps responsibility, always. If an option says management retains responsibility for risk decisions while internal audit advises, it is almost always the best answer. Any option in which internal audit takes decisions on risk responses is wrong.

Tip 5 - Self-review means outsourcing assurance. If internal audit built or operates part of the risk framework and assurance is required, the correct answer involves obtaining assurance from an independent, suitably qualified party, not simply using different audit staff.

Tip 6 - Remember the one-year rule. Questions about an auditor assessing an area they recently managed point to a cooling-off period of at least one year and reassignment or disclosure.

Tip 7 - Label it consulting. If a question asks how extended risk work should be treated, the answer is as a consulting engagement subject to the consulting-related standards, with clear communication to the client and board.

Tip 8 - Temporary beats permanent. Where options differ only in duration, the answer with a defined time limit and a plan to transfer responsibility to management is stronger than an open-ended arrangement.

Tip 9 - Be wary of extremes. Options stating that internal audit must never be involved in risk management activities are generally wrong; the IIA explicitly allows a consulting role. Equally, options saying internal audit may do anything if the board approves are wrong; board approval cannot legitimise Zone 3 roles such as setting risk appetite or implementing responses.

Tip 10 - Think in terms of perception. The Standards cover both actual and perceived impairments. If a scenario describes stakeholders who might believe internal audit is conflicted, disclosure to the board and a safeguard are required even if the auditor feels objective.

Quick Revision Summary

- Core assurance roles: always fine.
- Consulting roles (facilitate, coach, coordinate, consolidate, champion, develop framework or strategy): fine with safeguards.
- Prohibited roles (set appetite, impose processes, management assurance, decide or implement responses, accountability): never.
- Key safeguards: management owns risk; charter documents the role; board approves; no managing risks on management's behalf; no self-assurance - use independent party; treat as consulting; time limits and exit plan; cooling-off and rotation; disclose impairments.

Master the three zones and the safeguard list, and you will handle any CRMA question on this topic with confidence.