Forming an Overall Assessment of Risk Management

Introduction: Why This Topic Matters

Forming an overall assessment of risk management is one of the most strategically important responsibilities of the internal audit activity and a core competency tested on the IIA's Certification in Risk Management Assurance (CRMA) exam. It sits within the domain of Risk-Based Audit Planning and Engagements because it represents the culmination of everything internal audit does: individual engagements, continuous monitoring, reliance on other assurance providers, and professional judgment all converge into a single, defensible conclusion about whether the organization's risk management processes are adequate and effective.

Boards and audit committees increasingly ask one simple question: Is our risk management working? The Chief Audit Executive (CAE) is uniquely positioned to answer this because internal audit is the only function with an organization-wide, independent, and objective view. An overall assessment of risk management is therefore not an academic exercise; it directly supports governance, informs the board's oversight of strategy, and shapes the organization's ability to respond to emerging threats and opportunities.

For exam purposes, this topic is heavily tested because it integrates knowledge from several areas: the IIA Standards, risk management frameworks (COSO ERM and ISO 31000), the Three Lines Model, assurance mapping, maturity models, and engagement communication. Candidates who understand how the pieces fit together, rather than memorizing isolated facts, consistently perform better on these questions.

What Is an Overall Assessment of Risk Management?

An overall assessment of risk management is a conclusion, formed by the CAE, regarding the effectiveness of the organization's risk management processes as a whole. It is distinct from an engagement-level conclusion, which addresses only the specific area, process, or risk that was the subject of a single audit.

The IIA Standards establish the mandate for this work. Under the 2017 International Standards for the Professional Practice of Internal Auditing, Standard 2120 - Risk Management states that the internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes. Under the 2024 Global Internal Audit Standards, the same expectation is embedded in Standard 9.1 - Understanding Governance, Risk Management, and Control Processes, Standard 9.4 - Internal Audit Plan, and the requirement that the CAE communicate conclusions to the board. Both frameworks emphasize that the assessment must be based on sufficient, reliable, relevant, and useful information gathered through multiple engagements and other sources.

The Interpretation to Standard 2120 provides the key criteria for judging effectiveness. Risk management processes are effective when:

1. Organizational objectives support and align with the organization's mission.
2. Significant risks are identified and assessed.
3. Appropriate risk responses are selected that align risks with the organization's risk appetite.
4. Relevant risk information is captured and communicated in a timely manner across the organization, enabling staff, management, and the board to carry out their responsibilities.

These four criteria are the backbone of the overall assessment and are frequently the basis of exam questions. Memorize them and understand how each would be evidenced in practice.

The assessment also addresses a critical qualifier: the determination of whether risk management processes are effective is a judgment resulting from the internal auditor's assessment. It is not a mechanical calculation. It requires professional skepticism, an understanding of the organization's context, and the ability to weigh evidence from diverse sources.

Overall Opinion vs. Overall Assessment

Candidates sometimes confuse these terms. Under 2017 Standard 2450 - Overall Opinions, when an overall opinion is issued, it must take into account the strategies, objectives, and risks of the organization and the expectations of senior management, the board, and other stakeholders, and must be supported by sufficient, reliable, relevant, and useful information. An overall assessment of risk management may be delivered as a formal overall opinion, as part of an annual report to the board, or as a narrative conclusion that avoids a formal opinion while still communicating the CAE's judgment. The exam expects you to know that any form of overall conclusion must be evidence-based, must disclose its scope and limitations, and must be communicated to the board.

How It Works: The Process of Forming the Assessment

Step 1: Establish the Criteria and Framework

Before internal audit can assess risk management, it must determine what good looks like. This usually involves agreeing with management and the board on a reference framework such as COSO Enterprise Risk Management - Integrating with Strategy and Performance or ISO 31000 Risk Management - Guidelines. The IIA Practice Guide on assessing the adequacy of risk management using ISO 31000 is a commonly cited resource. If the organization has adopted its own framework, internal audit evaluates it against recognized principles and uses it as the benchmark.

A key exam point: if no formal criteria exist, internal audit must work with management to identify appropriate criteria. Internal audit should not simply invent standards unilaterally, nor should it refrain from assessing because criteria are absent.

Step 2: Understand the Organization's Risk Management Maturity

Most organizations use a maturity model to describe where they are on the journey. A widely referenced scale moves from risk naive (no formal approach), to risk aware (scattered, silo-based approaches), to risk defined (strategy and policies in place and communicated), to risk managed (enterprise-wide approach developed and communicated), to risk enabled (risk management fully embedded in operations and decision making).

The organization's maturity directly determines the nature of internal audit's work. In a low-maturity organization, internal audit may primarily use management's limited risk information supplemented by its own risk assessment, and may provide consulting support to help build the framework. In a mature organization, internal audit can place greater reliance on management's risk registers and assessments and focus on validating their accuracy and completeness. The exam frequently tests whether you can match the appropriate internal audit role to the maturity level.

Step 3: Gather Evidence From Multiple Sources

An overall assessment can never rest on a single engagement. The CAE aggregates evidence from:

- Results of individual assurance engagements over the audit period, including both engagements that specifically evaluated risk management processes and operational, financial, compliance, and IT audits that incidentally tested how risks were identified and managed.
- Consulting engagements, where insights about risk culture and process design were gained.
- Work of other internal and external assurance providers (second line functions such as risk management, compliance, quality, health and safety; external auditors; regulators), evaluated for reliability before reliance is placed on them, consistent with Standard 2050 (2017) or Standard 9.5 Coordination and Reliance (2024).
- Assurance maps that identify where coverage exists and where gaps remain.
- Management's own risk assessments, control self-assessments, key risk indicators, and incident and loss data.
- Observations about governance, risk appetite statements, board reporting, and risk culture.

Step 4: Evaluate Design and Operating Effectiveness

The assessment must consider both whether the risk management framework is designed appropriately and whether it operates as intended. A well-written risk policy that is ignored in practice is not effective. Internal audit tests this by observing whether risk assessments are actually used in decision making, whether risk responses are implemented and monitored, whether escalation occurs when limits are breached, and whether risk reporting reaches the board in a timely and useful form.

Step 5: Aggregate and Weigh the Evidence

The CAE must then synthesize findings. This involves considering the significance and pervasiveness of weaknesses, whether issues are isolated or systemic, whether root causes point to framework design or to execution, and whether management has taken corrective action. The CAE also considers the risk of fraud, emerging risks, and the adequacy of risk management for the organization's most strategic objectives, not just routine operations.

An important nuance: the overall assessment should reflect the scope of work actually performed. If significant areas were not covered during the period, the CAE must disclose scope limitations rather than extrapolate assurance to areas not examined.

Step 6: Communicate the Conclusion

The overall assessment is communicated to senior management and the board, typically in an annual report or at a frequency the board requests. The communication should state the criteria used, the scope and period covered, the level of assurance being provided, any limitations, significant weaknesses and themes, improvement recommendations, and management's response. The CAE should be clear about what the assessment does and does not cover and should avoid implying absolute assurance.

Key Principles the Exam Expects You to Apply

Internal audit does not own risk management. Under 2120.C3 (2017) and the Three Lines Model, internal audit may help management establish or improve risk management processes but must not assume management responsibility for managing risks. Any question suggesting that internal audit set risk appetite, decide risk responses, or take ownership of the risk register has an incorrect answer embedded in it.

Independence and objectivity must be safeguarded. If internal audit has provided significant consulting assistance in building the framework, this must be disclosed, and the CAE should consider whether an objectivity impairment affects the assurance conclusion.

Risk appetite is the anchor. Criterion three of Standard 2120 asks whether risk responses align risks with the organization's risk appetite. If the organization has not articulated its risk appetite, that is itself a significant finding affecting the overall assessment.

Evidence must be sufficient, reliable, relevant, and useful. This phrase appears repeatedly in the Standards and is a common distractor-check in exam questions.

The assessment is forward-looking as well as retrospective. Effective risk management anticipates emerging risks; internal audit's evaluation should consider whether processes exist to identify new and changing risks, not only whether past risks were managed.

Common Pitfalls in Practice and in the Exam

- Basing an overall conclusion on a single engagement or an unrepresentative sample of engagements.
- Relying on second line assurance without first evaluating the competence, objectivity, and due professional care of the provider.
- Confusing the existence of a framework document with effective operation.
- Providing a positive overall opinion while significant scope limitations exist and are not disclosed.
- Treating the assessment as a one-time event rather than a continuous process refreshed through the audit plan.
- Allowing management disagreement to alter the conclusion without additional evidence; the correct response is to report both the conclusion and management's position.

Exam Tips: Answering Questions on Forming an Overall Assessment of Risk Management

Tip 1: Anchor every answer in the Standards. When a question asks what internal audit must do, recall Standard 2120 (2017) or Standards 9.1 and 9.4 (2024). The four effectiveness criteria (objectives aligned with mission, significant risks identified and assessed, responses aligned with risk appetite, timely communication of risk information) are the most direct source of correct answers. If an option restates one of these criteria, it is very likely correct.

Tip 2: Watch for role confusion. Eliminate any option that has internal audit setting risk appetite, owning risks, making risk response decisions, or taking accountability for risk management. The exam loves to test the boundary between assurance, consulting, and management responsibility. The correct answer preserves management ownership and internal audit independence.

Tip 3: Prefer the answer that aggregates multiple sources. If asked how the CAE should form an overall assessment, the best answer references combining results from multiple engagements, other assurance providers, and management information, not relying on one audit or one risk register.

Tip 4: Match internal audit's approach to the organization's maturity. If the scenario describes a risk naive or risk aware organization, the appropriate response involves internal audit performing its own risk assessment, promoting risk management, and possibly offering consulting support while disclosing the impact on objectivity. If the organization is risk managed or risk enabled, the appropriate response involves evaluating and validating management's processes and placing greater reliance on them.

Tip 5: Remember that evidence quality qualifiers matter. Look for the phrase sufficient, reliable, relevant, and useful. Options that describe conclusions based on management assertions alone, informal discussions, or untested data are usually distractors.

Tip 6: Distinguish design from operating effectiveness. If a scenario describes a comprehensive policy that staff do not follow, the correct conclusion is that risk management is not operating effectively, regardless of how good the policy looks.

Tip 7: Disclosure beats silence. When a question involves scope limitations, reliance on others, or an objectivity impairment, the correct answer almost always involves disclosing the matter in the communication rather than omitting it or declining to report.

Tip 8: Know who receives the assessment. The overall assessment of risk management is communicated to the board (or audit committee) and senior management. Options that route the overall conclusion only to operational management or only to the risk function are incorrect.

Tip 9: Handle management disagreement correctly. If management disagrees with the overall conclusion, the CAE should consider whether additional evidence changes the view; if not, the CAE reports the conclusion along with management's position and the reasons for disagreement. The CAE does not simply adopt management's view, nor does the CAE refuse to report.

Tip 10: Read for the keyword best or most appropriate. Many options will be partially correct. Choose the one that is most complete, most consistent with the Standards, and most protective of independence and objectivity. A good test is to ask which option the IIA would publish as guidance.

Worked Example

Scenario: The CAE of a mid-sized organization is preparing the annual report to the audit committee. During the year, internal audit completed twelve assurance engagements, two of which specifically evaluated the enterprise risk management framework. The risk management function has also provided its own assessment. Internal audit has not yet evaluated the reliability of the risk function's work. The CAE is asked to provide an overall conclusion on the effectiveness of risk management.

Question: What is the most appropriate course of action?

A. Issue a positive overall opinion based on the two framework engagements, since they addressed risk management directly.
B. Combine the results of all twelve engagements with the risk function's assessment after evaluating the reliability of the risk function's work, and clearly disclose the scope and any limitations in the conclusion.
C. Defer the overall conclusion until internal audit has audited every business unit.
D. Adopt the risk function's conclusion since it is the second line and closest to the risks.

Analysis: Option A relies on too narrow a base and ignores relevant evidence from the other ten engagements. Option C sets an impossible standard; an overall assessment reflects work performed and discloses limitations. Option D abdicates independence and relies on work not evaluated for reliability. Option B aggregates multiple sources, applies the reliance requirements of the Standards, and discloses scope, which is exactly what the Standards require. Correct answer: B.

Quick Revision Checklist

- Standard 2120 (2017) / Standards 9.1 and 9.4 (2024): internal audit must evaluate the effectiveness of risk management.
- Four criteria of effective risk management: objectives aligned with mission; significant risks identified and assessed; responses aligned with risk appetite; timely communication of risk information.
- Effectiveness determination is a professional judgment based on sufficient, reliable, relevant, and useful information.
- Aggregate evidence from multiple engagements, other assurance providers (after evaluating reliability), assurance maps, and management information.
- Evaluate both design and operating effectiveness.
- Use a recognized framework (COSO ERM, ISO 31000) or agreed criteria; work with management if criteria are absent.
- Tailor internal audit's role to organizational risk maturity.
- Never assume management responsibility for risk management; disclose consulting involvement.
- Communicate to the board and senior management with clear scope, criteria, level of assurance, limitations, and management responses.

Conclusion

Forming an overall assessment of risk management is where internal audit demonstrates its greatest value to the board. It requires more than technical testing; it demands the ability to synthesize evidence across the organization, apply recognized criteria with professional judgment, respect the boundaries between internal audit and management, and communicate conclusions with clarity and integrity. For the CRMA exam, mastering the Standard 2120 criteria, the maturity-based approach, the reliance requirements, and the communication expectations will equip you to recognize the best answer in virtually any scenario on this topic.