Using Management's Risk Assessment in Planning

1. Why This Topic Matters for the CRMA Exam

The Certification in Risk Management Assurance (CRMA) tests whether you understand how internal audit provides assurance over risk management processes and how it builds its own work around organizational risk. One of the most practical and heavily examined ideas in the Risk-Based Audit Planning and Engagements domain is how the Chief Audit Executive (CAE) and audit staff should use management's risk assessment when developing the annual (or rolling) audit plan and when planning individual engagements.

This matters because:
• The IIA Standards require the internal audit plan to be risk-based and to consider the organization's risk management framework and risk appetite.
• Management's risk assessment (usually produced through an ERM process) is the single richest source of information about what the organization believes its key risks are.
• At the same time, internal audit must remain independent and objective. If internal audit simply copies management's risk register into its audit plan, it loses its independent perspective and may miss risks management has overlooked, understated, or deliberately minimized.
• The exam loves the tension between leveraging management's work and not relying blindly on it. Most questions in this area probe whether you understand that balance.

2. What Is Management's Risk Assessment?

Management's risk assessment is the organization's own structured evaluation of the risks that could affect the achievement of its objectives. Depending on the maturity of the organization, it may take the form of:
• An enterprise risk register listing risks, owners, likelihood, impact, and existing controls.
• Heat maps plotting likelihood against impact.
• Risk appetite and tolerance statements approved by the board.
• Business-unit or process-level risk and control self-assessments (RCSAs).
• Risk reports produced by a Chief Risk Officer, ERM committee, or second-line functions (compliance, IT security, finance).
• Strategic planning documents that identify risks to strategic objectives.

Key vocabulary you must know:
• Inherent risk – the level of risk before considering any management controls or responses.
• Residual risk – the risk remaining after management's responses and controls are applied.
• Risk appetite – the aggregate level of risk the organization is willing to accept in pursuit of its objectives.
• Risk tolerance – the acceptable variation around specific objectives.
• Risk maturity – how well developed, embedded, and reliable the organization's risk management processes are (often described on a scale such as risk naive, risk aware, risk defined, risk managed, risk enabled).

3. What the IIA Standards Say

Under the 2017 International Standards for the Professional Practice of Internal Auditing (still widely referenced in exam materials):
• Standard 2010 – Planning: The CAE must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization's goals.
• Standard 2010.A1: The plan must be based on a documented risk assessment, undertaken at least annually, and the input of senior management and the board must be considered.
• Interpretation of 2010: The CAE is responsible for developing a risk-based plan and takes into account the organization's risk management framework, including using risk appetite levels set by management. If a framework does not exist, the CAE uses his or her own judgment of risks after consideration of input from senior management and the board.
• Standard 2120 – Risk Management: Internal audit must evaluate the effectiveness and contribute to the improvement of risk management processes.
• Standard 2201 – Planning Considerations: In planning an engagement, internal auditors must consider the significant risks to the activity, its objectives, resources, and operations, and the means by which the potential impact of risk is kept to an acceptable level; and the adequacy and effectiveness of the activity's governance, risk management, and control processes compared to a relevant framework.

Under the Global Internal Audit Standards (effective 2025), the same principles appear in Domain IV and V: the CAE must develop an internal audit plan based on a documented assessment of the organization's strategies, objectives, and risks, informed by input from the board and senior management (Standard 9.4), and engagement planning must include an engagement risk assessment (Standard 13.2). The wording differs, but the logic is identical: management's assessment is an important input, not a substitute for internal audit's own judgment.

4. How It Works: Using Management's Risk Assessment Step by Step

Step 1 – Obtain and understand the assessment. The CAE gathers the ERM output: risk register, heat maps, appetite statements, risk committee minutes, strategic plans, and second-line reports. The auditor should understand the methodology (how likelihood and impact were scored, who participated, when it was last updated).

Step 2 – Evaluate the reliability and maturity of the risk management process. Before relying on management's assessment, internal audit must assess how robust it is. Questions include: Is there a defined ERM framework (e.g., COSO ERM, ISO 31000)? Is risk identification comprehensive and bottom-up as well as top-down? Are risk owners accountable? Are assessments updated when conditions change? Has the board approved the risk appetite? The greater the risk maturity, the more reliance internal audit can place on management's assessment. In a risk-naive organization, internal audit must perform substantially more of its own risk identification.

Step 3 – Validate and challenge the content. Internal audit applies professional skepticism. Typical validation activities include: comparing management's risk ratings with internal audit's own knowledge from prior engagements; checking for omitted risks (emerging risks, fraud risk, third-party risk, culture, IT and cyber, regulatory change); testing whether residual risk ratings are justified by actually effective controls rather than assumed controls; and looking for bias (business units understating risk to avoid scrutiny).

Step 4 – Reconcile with internal audit's independent risk assessment. The CAE maintains an audit universe (all auditable entities, processes, systems, and locations) and assigns risk scores to each. Management's assessment is mapped against this universe. Where internal audit and management agree, the plan can focus assurance effort on high residual risks and on validating that key controls operate. Where they disagree, the CAE documents the difference, discusses it with management, and if unresolved, raises it with the board or audit committee. Internal audit's rating ultimately prevails for audit planning because the CAE owns the plan.

Step 5 – Incorporate risk appetite. Areas where residual risk exceeds appetite are natural priorities, since either controls are inadequate or management has accepted risk the board may not know about. Standard 2600 (communicating the acceptance of risks) is relevant here: if the CAE concludes management has accepted a level of risk that may be unacceptable to the organization, the matter must be discussed with senior management and, if unresolved, communicated to the board.

Step 6 – Build and prioritize the plan. High-risk areas receive more frequent and deeper coverage; lower-risk areas may be covered on a cycle or through continuous auditing. The plan should also reserve capacity for emerging risks, management requests, and consulting engagements. The CAE presents the plan, the methodology, and significant interim changes to senior management and the board for review and approval.

Step 7 – Use management's assessment at the engagement level. During engagement planning (Standard 2201 / 13.2), the auditor obtains the process-level risk assessment and RCSA, interviews the risk owner, and uses this to define engagement objectives and scope. The auditor must still identify risks independently and test whether the controls management claims exist actually operate. Engagement objectives should reflect the results of the auditor's preliminary risk assessment, informed by but not dictated by management's view.

Step 8 – Keep it dynamic and document everything. Risk is not static. The CAE should revisit the plan whenever significant changes occur (new strategy, acquisition, regulatory shift, major incident) and should document the sources used, the reliance placed on management's assessment, and the rationale for any differences. Documentation supports quality assurance reviews and board reporting.

5. Benefits and Risks of Using Management's Assessment

Benefits:
• Efficiency – avoids duplicating risk identification work already performed.
• Alignment – ensures audit focuses on what matters to strategy and objectives.
• Common language – uses the same risk taxonomy, enabling clearer reporting to the board.
• Supports Standard 2120 – reviewing management's assessment is itself a way of evaluating risk management effectiveness.

Risks (and the exam will test these):
• Loss of independence if internal audit adopts management's view without challenge.
• Blind spots – risks unknown to or ignored by management are missed.
• Optimism bias – management may rate residual risk too low based on controls that are poorly designed or not operating.
• Stale data – assessments done once a year may not capture emerging risks.
• Role confusion – internal audit must not take ownership of the risk assessment itself. According to the IIA Position Paper on internal audit's role in ERM, setting risk appetite, imposing risk management processes, taking decisions on risk responses, and being accountable for risk management are roles internal audit should not undertake.

6. The Three Lines Model Connection

Management (first line) owns and manages risk; risk and compliance functions (second line) support and monitor; internal audit (third line) provides independent assurance. Management's risk assessment is a first- and second-line product. Internal audit uses it, assesses it, and reports on its reliability, but does not create or own it. When answering questions, always position internal audit as the independent third line that evaluates management's risk assessment rather than performs it.

7. Exam Tips: Answering Questions on Using Management's Risk Assessment in Planning

Tip 1 – Look for the word that signals over-reliance. Answer options containing words like sole basis, exclusively, adopt without modification, accept management's ratings, or rely entirely are almost always wrong. The correct answer will describe management's assessment as an input, a starting point, or something to be considered and validated.

Tip 2 – Remember the maturity rule. If the stem says the organization has a mature, board-approved ERM process, the best answer allows greater reliance with validation. If the stem says risk management is informal, immature, or nonexistent, the best answer is that the CAE performs an independent risk assessment using professional judgment and input from senior management and the board.

Tip 3 – Know what to do when internal audit disagrees with management. The sequence is: document the difference, discuss it with management, and if unresolved and significant, escalate to the board or audit committee. Internal audit does not simply defer to management, nor does it ignore management's view.

Tip 4 – Distinguish inherent from residual risk. Audit planning generally prioritizes areas based on residual risk and the reliability of the controls that reduce inherent risk. If a question notes that controls have never been tested, the correct answer usually treats management's residual risk rating with skepticism or plans to test the key controls.

Tip 5 – Standards citations. Questions may ask which Standard requires consideration of management and board input in planning (2010.A1 / Global Standard 9.4), which Standard addresses engagement-level risk consideration (2201 / 13.2), and which addresses communicating unacceptable risk acceptance (2600). Memorize these pairings.

Tip 6 – Independence and role boundaries. If an option has internal audit setting risk appetite, deciding risk responses, or owning the risk register, eliminate it. If an option has internal audit facilitating workshops or coaching management with safeguards, that is a permissible consulting role, but it is not the same as using the assessment for planning.

Tip 7 – Frequency and change. The risk assessment supporting the plan must be performed at least annually, but the best answers recognize that the plan should be updated when significant changes occur. Options implying the plan is fixed for the year regardless of events are wrong.

Tip 8 – Watch for the most appropriate first step framing. When the question asks what the CAE should do first upon receiving management's risk assessment, the best answer is usually to evaluate the methodology and reliability of the assessment before using it, not to immediately build the plan from it.

Tip 9 – Use elimination logic. For each option ask: Does it preserve independence? Does it use management's work efficiently? Does it involve the board appropriately? Does it keep ownership of risk with management? The option that satisfies all four is the answer.

8. Worked Example

Question: The CAE of a company with an established ERM function led by a Chief Risk Officer is preparing the annual internal audit plan. The CRO has provided a current enterprise risk register with residual risk ratings. Which of the following is the MOST appropriate action for the CAE?
A. Adopt the risk register as the audit universe and schedule engagements in order of residual risk rating.
B. Disregard the register and perform a fully independent risk assessment to protect independence.
C. Use the register as a key input, assess the reliability of the ERM process, validate significant ratings, and reconcile differences before finalizing the plan with board input.
D. Ask the CRO to approve the audit plan to ensure alignment with ERM.

Analysis: A relies exclusively on management's view and confuses the risk register with the audit universe. B wastes available information and ignores the Standards' requirement to consider the risk management framework and management input. D compromises independence since the board, not the CRO, approves the plan. C is correct because it uses management's work efficiently while preserving independent judgment and board involvement.

9. Quick Revision Summary

• Management's risk assessment is a valuable input, never the sole basis, for the audit plan.
• The degree of reliance depends on the maturity and reliability of the organization's risk management process.
• Internal audit must validate, challenge, and reconcile management's ratings with its own assessment.
• Differences are discussed with management and escalated to the board if unresolved.
• The risk assessment must be documented and performed at least annually, with the plan adjusted for significant change.
• Internal audit evaluates risk management (Standard 2120) but does not own it; ownership stays with management (first and second lines).
• At the engagement level, management's process-level assessment informs objectives and scope, but the auditor performs an independent preliminary risk assessment (Standard 2201 / 13.2).

Master these principles and you will be well prepared for the CRMA questions on this topic, which consistently reward the candidate who balances efficient use of management's work with uncompromising independence and professional skepticism.