Assurance services on risk management refer to the independent, objective evaluations that internal auditors perform to assess whether an organization's risk management processes are adequately designed, operating effectively, and achieving their intended objectives. Within the Certification in Risk Management Assurance (CRMA) framework, this is a core competency, as the certification emphasizes the internal auditor's ability to provide stakeholders with confidence that risks are being identified, assessed, managed, and monitored appropriately.

Internal audit's assurance role in risk management typically includes several key activities. First, auditors evaluate the overall risk management framework, examining whether governance structures, risk appetite statements, policies, and reporting mechanisms are aligned with the organization's strategy and regulatory expectations. Second, they assess the risk identification and assessment processes, verifying that significant risks are captured, properly rated, and prioritized. Third, auditors test the effectiveness of risk responses and controls, confirming that mitigation activities actually reduce risk exposure as intended. Fourth, they review risk reporting to ensure management and the board receive accurate, timely, and complete risk information for decision-making.

A critical principle is independence. According to The IIA's guidance, including the Three Lines Model, internal audit serves as the third line, distinct from management (first line) and risk and compliance functions (second line). Internal auditors may provide assurance on risk management but must avoid taking ownership of risks, setting risk appetite, or making management decisions, since doing so would impair objectivity. When internal audit performs consulting activities related to risk management, appropriate safeguards must be in place.

Assurance engagements conclude with formal opinions or ratings communicated to senior management and the audit committee, highlighting weaknesses, recommending improvements, and tracking remediation. Ultimately, assurance services on risk management strengthen governance, support strategic objectives, and enhance stakeholder trust by demonstrating that risk is managed within acceptable tolerances across the enterprise.

Within the Certification in Risk Management Assurance (CRMA) framework, internal auditors are recognized not only for providing independent assurance over risk management but also for delivering advisory and consulting services that help organizations strengthen their risk management capabilities. Advisory and consulting services are activities performed at the request of management, where the nature and scope are agreed upon in advance, and where the internal audit function offers insight, facilitation, training, or recommendations without assuming management responsibility for risk decisions.

Typical advisory roles include facilitating risk identification and assessment workshops, coaching management on developing risk responses, advising on the design of control frameworks, supporting the implementation of enterprise risk management (ERM), and helping integrate risk management into strategic planning and governance processes. Internal auditors may also champion the development of a risk-aware culture and provide education on emerging risks, regulatory expectations, and risk appetite concepts.

The IIA's Three Lines Model and the Global Internal Audit Standards emphasize that these services must be delivered while safeguarding independence and objectivity. The Standards require that auditors must not set risk appetite, impose risk management processes, make decisions on risk responses, implement responses on management's behalf, or assume ownership or accountability for risk. When auditors provide significant consulting on a risk area, they should disclose this and, where necessary, arrange for assurance work on that area to be performed by others or after an appropriate cooling-off period.

The value of advisory services lies in leveraging internal audit's enterprise-wide perspective, control expertise, and analytical skills to help the organization mature its risk management practices, particularly in less developed environments. The Chief Audit Executive must ensure such engagements are documented in the audit charter, approved by the board or audit committee, properly resourced, and communicated clearly so stakeholders understand the distinction between assurance conclusions and advisory recommendations. Effective balance between the two roles enhances organizational governance while preserving the credibility of internal audit's independent assurance mandate.

In the context of the Certification in Risk Management Assurance (CRMA) and the IIA's guidance on internal audit's role in Enterprise Risk Management (ERM), the 'core' internal audit roles are the assurance activities that internal audit should perform regarding an organization's risk management processes. These roles are fully consistent with internal audit's independent and objective assurance mandate and are often depicted at the center of the IIA's 'fan' diagram of ERM roles.

The core roles include: (1) Giving assurance on the risk management processes – evaluating whether the ERM framework is designed appropriately and operating effectively, including risk identification, assessment, response, monitoring, and reporting activities. (2) Giving assurance that risks are correctly evaluated – reviewing whether management's assessments of likelihood and impact are reasonable, consistent, and aligned with the organization's risk appetite. (3) Evaluating risk management processes – assessing the overall maturity of ERM against recognized frameworks such as COSO ERM or ISO 31000. (4) Evaluating the reporting of key risks – confirming that risk information communicated to senior management and the board is accurate, complete, and timely. (5) Reviewing the management of key risks – verifying that controls and risk responses for the most significant risks are adequate and functioning as intended.

These roles align with the IIA's International Professional Practices Framework (IPPF) and Global Internal Audit Standards, which require internal audit to evaluate the effectiveness of risk management and contribute to its improvement. Because they are assurance-based, core roles do not compromise independence, unlike legitimate 'consulting' roles (such as facilitating risk workshops or coaching management) that require safeguards, or roles internal audit should never undertake, such as setting risk appetite, owning risks, or making risk response decisions. By performing these core roles, internal audit provides the board and audit committee with confidence that the organization's ERM processes are reliable and that significant risks are managed within acceptable tolerances.

In the Certification in Risk Management Assurance (CRMA) body of knowledge, the IIA's position paper 'The Role of Internal Auditing in Enterprise-wide Risk Management' (often illustrated by the 'fan' diagram) divides internal audit's possible ERM activities into three categories: core assurance roles, legitimate roles requiring safeguards, and roles internal audit should not undertake. The middle category, 'Roles That Need Safeguards,' consists of consulting activities that add value but could threaten independence and objectivity if not carefully managed. These roles include: facilitating the identification and evaluation of risks; coaching management in responding to risks; coordinating ERM activities; consolidating risk reporting; maintaining and developing the ERM framework; championing the establishment of ERM; and developing a risk management strategy for board approval. These activities are acceptable because they draw on internal audit's risk expertise, but they place auditors close to management's decision-making. To preserve independence, specific safeguards must be applied. First, management must remain clearly responsible for risk management; internal audit facilitates but never owns risks, sets risk appetite, decides on responses, or implements controls. Second, the nature of the consulting role should be documented in the internal audit charter and approved by the board or audit committee. Third, internal audit should not later provide assurance on any part of the ERM framework it helped design or implement; a separate party or a cooling-off period should be used. Fourth, any consulting activity should be disclosed in reports to the audit committee, and the chief audit executive should regularly assess whether the balance of consulting work is impairing objectivity. Fifth, auditors should offer advice rather than make decisions, with management formally accepting recommendations. Finally, these roles are generally expected to be transitional, particularly in organizations with immature ERM, with responsibility transferring to a dedicated risk function as maturity grows. Applying these safeguards allows internal audit to support ERM while retaining credibility as an independent assurance provider.

Within the Certification in Risk Management Assurance (CRMA) body of knowledge, the IIA Position Paper 'The Role of Internal Auditing in Enterprise-wide Risk Management' uses a 'fan' diagram dividing activities into core assurance roles, legitimate consulting roles (with safeguards), and roles internal audit should NOT undertake. The prohibited roles exist because they would compromise the independence and objectivity that make internal audit's assurance credible to the board and audit committee. Internal audit should not: (1) Set the risk appetite – deciding how much risk the organization is willing to accept is a board and executive management responsibility; (2) Impose risk management processes – internal audit may advise or facilitate, but ownership of the ERM framework and its design belongs to management; (3) Provide management assurance on risks – internal audit gives independent assurance to the board, not management's own assurance on the effectiveness of risk responses, which would mean auditing its own work; (4) Take decisions on risk responses – choosing to accept, avoid, transfer, or mitigate a risk is a management decision; (5) Implement risk responses on management's behalf – executing controls or treatment plans makes internal audit part of the first or second line, creating a self-review threat; and (6) Be accountable for risk management – ultimate responsibility rests with the board and senior management, and internal audit cannot be the 'risk owner.' The underlying principle is that internal audit must not assume management responsibilities or ownership of risk. Where management lacks ERM maturity and asks internal audit for extensive help, the CAE should ensure management retains decision rights and accountability, document the arrangements, obtain board/audit committee approval, and avoid later assurance over areas it directly influenced (typically for at least a year). Breaching these boundaries undermines the Three Lines Model, creates conflicts of interest, and violates the IIA Standards on independence and objectivity (Standards 1100, 1120, 1130). Thus, internal audit can be a champion and facilitator of ERM, but never its owner.

When management or the board asks internal audit to address a risk, the Chief Audit Executive must decide whether to respond with an assurance engagement or an advisory (consulting) engagement. This choice is central to the CRMA body of knowledge because it determines the audit function's role, the level of independence required, and how results are communicated.

Assurance engagements involve an objective examination of evidence to provide an independent opinion or conclusion on governance, risk management, or control processes. They are appropriate when stakeholders need independent confidence that risks are being identified, assessed, and managed effectively, and when management already owns the risk and its controls. Internal audit sets the scope, follows the Standards rigorously, and reports conclusions to senior management and the board. Independence and objectivity must be fully preserved.

Advisory engagements are agreed upon with the client and aim to add value and improve processes without the auditor assuming management responsibility. They suit situations where risk management is immature, where management wants help designing a risk framework, facilitating risk workshops, or developing control approaches, or where no formal opinion is required. Here, the nature and scope are negotiated, and internal audit must guard against later auditing its own work; the IIA requires safeguards such as not performing advisory and assurance on the same area within a year unless objectivity risks are managed.

Key decision factors include: who owns the risk, the maturity of the organization's ERM, stakeholder expectations for an independent opinion, the potential threat to independence, available skills and resources, and whether the request falls within the audit charter. The CAE should also consult the Three Lines Model, ensuring internal audit does not take on first- or second-line responsibilities. The decision must be documented, communicated to the audit committee, and reflected in the risk-based audit plan so the role chosen is transparent and defensible.

When an organization has no formal risk management process, internal audit faces a distinctive challenge because its assurance work normally depends on management's own identification and assessment of risks. The IIA's International Professional Practices Framework, particularly Standard 2120 (Risk Management) and the related Practice Advisories, addresses this situation directly and is a core topic within the Certification in Risk Management Assurance (CRMA) body of knowledge.

First, internal audit must recognize and communicate the gap. The Chief Audit Executive (CAE) should bring the absence of a risk management framework to the attention of senior management and the board, explaining the governance implications and the exposure this creates. This is a reporting obligation, not an option.

Second, internal audit can act as a catalyst and consultant. In a consulting capacity, auditors may facilitate risk workshops, help management articulate risk appetite, propose frameworks such as COSO ERM or ISO 31000, and assist in developing risk registers. Such involvement is permitted and often valuable, provided safeguards exist: management must retain ownership of risks and decisions, and internal audit should not design and later assure the same process without appropriate independence mitigations.

Third, internal audit must still base its own audit plan on risk. In the absence of a management-led assessment, the CAE performs an independent risk assessment, using interviews, strategic documents, external data, and professional judgment to identify key exposures. This ensures audit resources focus on areas of greatest significance even without a formal enterprise process.

Fourth, internal audit should avoid assuming management responsibilities. It must not set the risk appetite, own risk responses, or make risk management decisions, as doing so would compromise objectivity and blur the three lines model.

Finally, the CAE should document the limitations this creates for assurance coverage and periodically reassess maturity, encouraging progressive adoption of a sustainable risk management process that management ultimately owns.

The Certification in Risk Management Assurance (CRMA), offered by The Institute of Internal Auditors (IIA), validates an internal auditor's ability to provide assurance and advisory services on risk management processes. Within the context of internal audit roles and responsibilities, the competencies for risk management assurance can be grouped into several key areas.

1. Risk Management Frameworks and Governance: Practitioners must understand established frameworks such as COSO ERM and ISO 31000, and how boards and senior management define risk appetite, tolerance, and oversight structures. This enables auditors to evaluate whether governance arrangements adequately support effective risk management.

2. Risk Identification and Assessment: Competent professionals can evaluate how an organization identifies, analyzes, and prioritizes risks, including strategic, operational, financial, compliance, and emerging risks. They assess the quality of risk registers, scoring methodologies, and the linkage between risks and organizational objectives.

3. Control Evaluation and Risk Response: Auditors must assess whether risk responses (accept, avoid, mitigate, transfer) are appropriate and whether controls are designed and operating effectively to keep residual risk within acceptable levels.

4. Assurance Methodology and Independence: A core competency is designing and executing risk-based audit plans while maintaining objectivity. The IIA's Three Lines Model clarifies that internal audit provides independent assurance over first- and second-line risk activities, and must avoid taking ownership of risks or making management decisions.

5. Communication and Reporting: Professionals must clearly communicate risk insights, control gaps, and assurance conclusions to the audit committee, board, and management, translating technical findings into business-relevant language.

6. Professional Ethics and Standards: Adherence to the IIA's Global Internal Audit Standards and Code of Ethics underpins credibility, including integrity, confidentiality, and due professional care.

7. Business Acumen and Analytical Skills: Understanding the organization's industry, strategy, and data analytics enables auditors to provide meaningful, forward-looking risk assurance that adds organizational value.

Assessing internal audit skill gaps is a critical responsibility within the Certification in Risk Management Assurance (CRMA) framework, ensuring the internal audit function has the competencies required to provide effective risk management assurance. The IIA's International Standards (particularly Standard 1210, Proficiency) require internal auditors to collectively possess the knowledge, skills, and other competencies needed to perform their responsibilities. A skill gap assessment identifies the difference between the capabilities the function currently has and those it needs to deliver on its audit plan and strategic objectives.

The process typically begins with defining required competencies. This is driven by the organization's risk profile, the audit universe, emerging risks (such as cybersecurity, ESG, data analytics, and third-party risk), and stakeholder expectations. The IIA Global Internal Audit Competency Framework is a useful reference, covering areas such as professionalism, governance and risk management, business acumen, communication, and technical IT skills.

Next, the Chief Audit Executive (CAE) evaluates the current state of the team. Methods include self-assessments, performance reviews, certifications held (CIA, CRMA, CISA), post-engagement feedback, quality assurance and improvement program (QAIP) results, and analysis of past audit findings where expertise was lacking.

The gap analysis then maps current capabilities against requirements, prioritizing deficiencies by their impact on audit coverage and assurance quality. For example, inability to audit cloud environments or evaluate enterprise risk management maturity may represent high-priority gaps.

Finally, the CAE develops a remediation strategy. Options include targeted training and continuing professional education, hiring specialists, rotational programs with business units, co-sourcing or outsourcing specialized work, and leveraging guest auditors. Standard 1210.A1 explicitly requires the CAE to obtain competent advice when staff lack the needed skills.

Results should be reported to senior management and the audit committee, as resourcing adequacy is a governance matter. Regular reassessment, at least annually, ensures the function remains aligned with evolving risks and continues to add value through credible, competent assurance.

Developing risk management competence in staff is a core responsibility for internal audit leaders pursuing or holding the Certification in Risk Management Assurance (CRMA), because the credibility of risk-based assurance depends on the skills of the people delivering it. Internal audit's role in risk management, as described in the IIA's International Professional Practices Framework and the Three Lines Model, requires auditors to evaluate the design and effectiveness of governance, risk management, and control processes, and to provide independent assurance that key risks are being identified, assessed, and managed. This cannot be done well unless staff understand risk concepts deeply, not just as a checklist.

Building competence begins with a skills assessment. The Chief Audit Executive should map the organization's risk universe against the team's current knowledge, identifying gaps in areas such as enterprise risk management frameworks (COSO ERM, ISO 31000), risk appetite and tolerance, emerging risks like cybersecurity, ESG, and third-party exposure, and quantitative techniques for likelihood and impact analysis. Development plans should then combine formal training, professional certification (CRMA, CIA, CRISC), and experiential learning through rotations into business units or participation in risk workshops facilitated by management.

Mentoring and coaching are equally important. Senior auditors should model how to challenge management's risk assessments constructively, how to distinguish inherent from residual risk, and how to communicate findings in terms of risk exposure rather than mere control deficiencies. Scenario-based exercises and post-engagement debriefs reinforce judgment and professional skepticism.

Competence development must also respect independence. Internal audit may advise and facilitate risk management, but staff should be trained to recognize the boundary beyond which they would be taking ownership of risk decisions, which would impair objectivity. Safeguards and clear documentation of roles help maintain this line.

Finally, competence should be measured and sustained through continuing professional education, performance evaluations tied to risk-related skills, and periodic external quality assessments. Investing in staff capability ultimately strengthens the organization's ability to achieve its objectives while managing uncertainty.

Co-sourcing and outsourcing risk expertise are strategies internal audit functions use to access specialized skills they may not possess in-house, a key topic within the Certification in Risk Management Assurance (CRMA) and the broader discussion of internal audit roles and responsibilities.

Co-sourcing involves partnering with external specialists who work alongside the in-house internal audit team. The chief audit executive (CAE) retains ownership and control of the engagement, while external experts supplement capabilities in areas such as cybersecurity, actuarial modeling, derivatives, fraud forensics, or complex regulatory compliance. This arrangement allows knowledge transfer, preserves institutional understanding, and builds internal capacity over time while filling temporary or highly technical gaps.

Outsourcing, by contrast, transfers all or a substantial portion of the internal audit or risk assurance activity to an external provider. Organizations may choose full outsourcing when they lack scale to justify a permanent function, or partial outsourcing for specific audits. Even when outsourced, the IIA Standards require that the organization retain accountability: the board and senior management must designate an individual responsible for maintaining oversight of the activity, ensuring independence, objectivity, and conformance with the International Professional Practices Framework.

From a risk management assurance perspective, both approaches raise important considerations. The CAE must evaluate provider competence, independence, and potential conflicts of interest—for example, an external audit firm providing internal audit services may face regulatory prohibitions. Confidentiality of sensitive risk data, quality assurance, cost-effectiveness, and continuity of coverage must be addressed through clear contracts and service-level agreements.

CRMA candidates should understand that regardless of the sourcing model, internal audit's core responsibility remains providing independent, objective assurance on governance, risk management, and control processes. Co-sourcing and outsourcing are tools to enhance that assurance, not to abdicate it, and the CAE must communicate the chosen model and its implications clearly to the audit committee.

In the context of the Certification in Risk Management Assurance (CRMA) and internal audit roles and responsibilities, using external experts in risk engagements refers to the chief audit executive (CAE) obtaining competent advice and assistance from outside specialists when the internal audit activity lacks the knowledge, skills, or other competencies needed to perform all or part of an engagement. This is grounded in the IIA Standards, which require that engagements be performed with proficiency and due professional care, and that the CAE ensure the collective skills of the function are sufficient for the audit plan.

Risk engagements frequently involve highly technical or specialized areas such as cybersecurity, actuarial modeling, derivatives valuation, environmental compliance, forensic accounting, information systems, legal matters, or complex regulatory frameworks. When internal auditors cannot reasonably evaluate risk exposures or control effectiveness in these domains, engaging an external expert allows the internal audit activity to provide reliable assurance without compromising quality.

Key responsibilities when using external experts include: first, assessing the expert's qualifications, independence, and objectivity, including any relationships with management or the areas under review that could impair judgment; second, clearly defining the scope, objectives, deliverables, and reporting lines in an engagement letter; third, ensuring confidentiality and access to records; and fourth, supervising the work, reviewing conclusions, and determining whether the evidence obtained is sufficient and appropriate. Importantly, the CAE retains ultimate responsibility for the engagement conclusions and cannot delegate accountability to the external provider.

The use of experts should also be disclosed appropriately in engagement communications, particularly where the expert's work materially supports the opinion. From a CRMA perspective, leveraging external expertise strengthens the internal audit function's ability to assess risk management processes, support the board and audit committee, and add value by addressing emerging and specialized risks the organization faces, while safeguarding the independence and credibility of the assurance provided.

In the Certification in Risk Management Assurance (CRMA) framework and the broader internal audit profession, the principle of declining or adjusting work that lacks competence is rooted in the IIA's Global Internal Audit Standards, particularly the Competency principle. Internal auditors must only accept engagements for which they possess, or can obtain, the necessary knowledge, skills, and experience. When auditors lack the required competence for an assurance or advisory engagement, they have a professional obligation to either decline the work or adjust its scope so that it falls within their capabilities, or secure competent advice and assistance.

In risk management assurance roles, this is especially critical. Evaluating enterprise risk management (ERM) frameworks often requires specialized understanding of risk modeling, regulatory environments, information technology, or complex financial instruments. An auditor who proceeds without sufficient expertise risks issuing inaccurate conclusions, giving management and the board false assurance, and ultimately undermining the credibility of the internal audit function.

The Chief Audit Executive (CAE) bears primary responsibility here. The CAE must assess whether the internal audit function collectively holds the competencies needed before accepting an engagement. If gaps exist, options include co-sourcing with external specialists, providing training, reassigning staff with relevant skills, narrowing the engagement objectives, or formally declining the engagement and communicating the reasons to senior management and the board.

Declining or adjusting work is not a sign of weakness; it demonstrates integrity, objectivity, and due professional care. The IIA Code of Ethics requires auditors to perform only services for which they are qualified. Transparency is key: limitations in scope or competence must be disclosed in engagement communications so stakeholders can interpret results appropriately.

For CRMA candidates, understanding this principle reinforces that credible risk assurance depends on honest self-assessment, continuous professional development, and the courage to set boundaries that protect both the organization and the profession's reputation.

Organizational independence of internal audit refers to the structural positioning and reporting relationships that allow the internal audit activity to perform its work free from undue influence, interference, or conflicts of interest. Within the Certification in Risk Management Assurance (CRMA) framework and the Institute of Internal Auditors' (IIA) Global Internal Audit Standards, independence is a foundational attribute that enables auditors to provide objective, credible assurance on governance, risk management, and control processes.

Independence is achieved primarily through a dual reporting structure. The chief audit executive (CAE) reports functionally to the board or its audit committee and administratively to senior management, typically the CEO. Functional reporting means the board approves the internal audit charter, the risk-based audit plan, the budget and resource plan, and the appointment, remuneration, and removal of the CAE. The board also receives audit results directly and inquires whether any scope or resource limitations exist. Administrative reporting covers day-to-day matters such as HR policies, logistics, and internal communications, but must not compromise the CAE's ability to report findings candidly.

Several practices reinforce organizational independence: the CAE has unrestricted access to the board and audit committee, including private sessions without management present; the audit charter formally documents authority, scope, and reporting lines; and the internal audit function avoids assuming operational responsibilities over areas it audits. When auditors are assigned non-audit duties, safeguards and disclosures are required, and assurance over those areas should be provided by parties outside internal audit.

In risk management assurance specifically, independence matters because internal audit evaluates the effectiveness of the risk framework itself. If internal audit were subordinate to risk management or operational functions, its assessments of risk appetite, risk identification, and control design would lack credibility. Any impairment to independence, whether in fact or appearance, must be disclosed to appropriate parties.

Ultimately, organizational independence protects objectivity, strengthens governance, and ensures stakeholders can rely on internal audit's conclusions.

In the Certification in Risk Management Assurance (CRMA) body of knowledge, internal audit's organizational independence depends heavily on its reporting lines. The IIA's International Standards for the Professional Practice of Internal Auditing (Standard 1110 and its Interpretation) distinguish two types of reporting: functional and administrative.

Functional reporting refers to the chief audit executive (CAE) reporting to the board or its audit committee on matters that determine the authority, scope, and effectiveness of internal audit. The board exercises functional oversight by approving the internal audit charter, approving the risk-based audit plan and budget, receiving communications on audit results and performance, approving decisions regarding the appointment and removal of the CAE, approving the CAE's remuneration, and making inquiries to determine whether inappropriate scope or resource limitations exist. Functional reporting to the board is what ultimately safeguards independence, because it ensures internal audit cannot be unduly influenced by the management it evaluates.

Administrative reporting refers to the day-to-day relationship within the organization's management structure that enables internal audit operations. Typically the CAE reports administratively to the CEO or another senior executive. Administrative matters include budgeting and management accounting, human resource administration (such as payroll and personnel evaluations), internal communications and information flows, and administration of the organization's policies and procedures. This relationship provides practical support and organizational standing without conferring authority over audit scope or conclusions.

For CRMA candidates, the key insight is that the dual reporting structure is a control in itself. Functional reporting to the board protects objectivity in assurance over risk management, governance, and control, while administrative reporting to senior management ensures operational effectiveness and access. A CAE who reports administratively to a function being audited, or whose plan and budget are approved only by management, faces a threat to independence that must be disclosed to the board. Clear, documented reporting lines in the audit charter are therefore fundamental to credible risk management assurance.

In the context of the Certification in Risk Management Assurance (CRMA) and internal audit roles, 'impairments from risk management responsibilities' refers to threats to the internal audit function's independence and objectivity that arise when internal auditors take on roles that belong to management in the risk management process. The IIA's International Standards (and the IIA Position Paper on the Three Lines Model) make clear that management owns risk: it identifies, assesses, responds to, and monitors risks. Internal audit's core role is to provide independent assurance that these processes are designed and operating effectively. An impairment occurs when auditors cross this line—for example, by setting the organization's risk appetite, deciding on risk responses, implementing risk controls, taking accountability for risk management outcomes, or managing the ERM function on management's behalf. Once internal audit performs such activities, it cannot objectively audit them, because it would effectively be reviewing its own work, creating a self-review threat. The IIA's 'fan' model of ERM roles distinguishes core assurance roles (e.g., evaluating risk processes and reporting on key risks), legitimate consulting roles permitted with safeguards (e.g., facilitating risk workshops, coaching management, championing ERM), and roles internal audit should not undertake (e.g., owning risks, making risk decisions, implementing responses). Where auditors do take on consulting or facilitation activities, safeguards are required: clear documentation that management retains ownership, disclosure of the nature of the involvement, and ensuring that auditors do not later provide assurance over areas where they held operational responsibility, generally for at least one year. Standards 1120 and 1130 require individual auditors to avoid conflicts of interest and to disclose any impairment in fact or appearance to the Chief Audit Executive and, where significant, to the board. If the CAE has risk management duties, oversight of that area must be arranged from outside internal audit. Recognizing and managing these impairments preserves the credibility and value of internal audit's risk assurance.

In the CRMA body of knowledge, the role of the Chief Audit Executive (CAE) beyond internal auditing addresses situations where the CAE is asked, or expected, to take on responsibilities outside the core internal audit function, such as leading enterprise risk management (ERM), compliance, ethics, or control self-assessment programs. This is common in smaller organizations or where risk management functions are immature. The IIA Standards (Standard 1112 in the 2017 Standards and Standard 7.1, Organizational Independence, in the 2024 Global Internal Audit Standards) recognize that such roles can create real or perceived impairments to independence and objectivity, because the CAE could end up auditing activities for which they are accountable. To manage this, the CAE and the board must put safeguards in place. These include board approval and oversight of the additional role, periodic evaluation of reporting lines and responsibilities, clear documentation of the arrangement in the internal audit charter, and obtaining assurance over those non-audit activities from an independent party, such as another internal audit team member not involved in the activity, an external provider, or a co-sourced arrangement. The IIA position paper on internal auditing's role in ERM provides a useful framework: core assurance roles (evaluating risk processes and reporting on key risks) are appropriate; consulting roles (facilitating risk identification, coaching management, championing ERM) are legitimate with safeguards; and certain roles should never be undertaken, including setting risk appetite, imposing risk management processes, owning risks, making risk response decisions, or taking management's accountability for risk management. CRMA candidates are expected to understand that when the CAE operates beyond internal auditing, transparency with the board, time-limited arrangements, disclosure of impairments, and rotation back to pure assurance roles are essential. Ultimately, the goal is to add value while protecting the credibility and independence that make internal audit assurance meaningful to stakeholders.

When internal audit takes on a leading role in risk management work, it steps beyond its traditional assurance function and risks compromising the independence and objectivity that make its assurance credible. The Institute of Internal Auditors (IIA) Position Paper on the role of internal audit in enterprise-wide risk management (ERM) acknowledges that, especially in organizations with immature risk functions, internal audit may legitimately facilitate or even lead aspects of risk work — but only if specific safeguards are in place. These safeguards are central to the Certification in Risk Management Assurance (CRMA) body of knowledge.

First, it must be clear that management remains responsible for risk management. Internal audit may facilitate workshops, coach managers in identifying and assessing risks, coordinate ERM activities, or consolidate risk reporting, but the ownership of risks and the decisions about risk appetite and responses stay with management and the board. Internal audit should never set risk appetite, make risk response decisions, implement risk responses, or take accountability for risk management outcomes.

Second, the nature and scope of internal audit's involvement should be documented in the internal audit charter and approved by the audit committee or board. This transparency ensures governance bodies understand and consent to the dual role.

Third, any consulting or leading role should be treated as a temporary arrangement with a defined transition plan. Internal audit should help the organization build capacity so that risk management responsibility migrates to a dedicated risk function or line management over time.

Fourth, independence must be protected when providing assurance. If internal audit has led risk work in an area, assurance over that area should be performed by individuals not involved in the risk activity, or sourced externally, and the chief audit executive should disclose any impairments to the board.

Finally, periodic review by the audit committee of internal audit's role in risk management helps confirm the safeguards continue to operate effectively and that the function's independence remains intact.

In the Certification in Risk Management Assurance (CRMA) and internal audit context, reporting impairments to the board and management refers to the obligation of the chief audit executive (CAE) and internal auditors to disclose any circumstances that compromise, or appear to compromise, the independence of the internal audit activity or the objectivity of individual auditors. The IIA Standards (notably Standard 1130 and the Global Internal Audit Standards' principles on independence and objectivity) require that impairments, whether in fact or appearance, be disclosed to appropriate parties, with the nature of the disclosure depending on the nature of the impairment.

Impairments can arise from several sources: personal conflicts of interest (such as auditing an area where a relative works or where the auditor held a recent operational role), scope limitations imposed by management, restrictions on access to records, personnel, or property, resource limitations such as insufficient funding or staffing, and situations where the CAE has non-audit responsibilities (for example, overseeing risk management or compliance functions) that could be subject to audit review.

The reporting process typically works as follows. Individual auditors must promptly inform the CAE of any potential impairment before or during an engagement so that assignments can be reallocated. The CAE, in turn, must report significant impairments to senior management and the board, usually through the audit committee. If a scope limitation occurs, the CAE communicates its effect on the engagement and on the ability to draw conclusions. When the CAE's own independence is impaired, such as through dual roles, safeguards must be put in place and the arrangement disclosed to the board, with assurance over those areas obtained from an independent party.

From a risk management assurance perspective, this transparency is essential. Boards rely on internal audit for an objective view of risk management effectiveness; undisclosed impairments undermine the credibility of assurance, mislead governance decisions, and weaken the third line's value. Proper reporting therefore protects the integrity of assurance, supports informed oversight, and demonstrates professional accountability.

Within the Certification in Risk Management Assurance (CRMA) body of knowledge, recommending an organizationwide risk strategy is one of the key areas where internal audit can add value in enterprise risk management (ERM), while carefully preserving its independence and objectivity. The IIA's 'Three Lines Model' and related guidance (including the IIA Position Paper 'The Role of Internal Auditing in Enterprise-wide Risk Management') describe a spectrum of roles: core assurance roles, legitimate consulting roles with safeguards, and roles internal audit should not undertake. Recommending an organizationwide risk strategy sits in the middle category—a legitimate consulting role that is permitted only with appropriate safeguards.

In practice, this means internal audit may advise the board and senior management on how to design or improve a coherent, enterprise-level approach to risk. This can include recommending a risk governance structure, proposing a risk appetite and tolerance framework, suggesting a common risk language and taxonomy, advising on risk assessment methodologies, championing the establishment of ERM, and helping align risk management with strategic objectives. Internal audit draws on its organizationwide view, knowledge of controls, and familiarity with frameworks such as COSO ERM and ISO 31000 to offer informed, independent perspectives.

However, critical boundaries apply. Internal audit must not set the risk appetite, own or manage risks, make risk response decisions, implement risk responses, or take accountability for risk management—these belong to management (first and second lines) and the board. Safeguards include documenting the consulting nature of the work in the charter, ensuring management retains responsibility for decisions, disclosing the role to the audit committee, and avoiding later assurance on the same areas by the same auditors, or applying rotation and independent review where unavoidable.

For a CRMA candidate, the key takeaway is that internal audit can be a catalyst and advisor for an integrated risk strategy, but must never cross into management responsibility, thereby maintaining the credibility of its assurance role.

Advocating for Enterprise Risk Management (ERM) is a key responsibility for internal auditors, particularly those holding or pursuing the Certification in Risk Management Assurance (CRMA). While internal audit must remain independent and objective, the IIA's position paper on the three lines model and the CRMA framework recognize that auditors can legitimately champion ERM without compromising independence, provided they do not assume management's ownership of risk decisions.

Advocacy begins with educating the board, audit committee, and senior management about the value of a structured, enterprise-wide approach to identifying, assessing, responding to, and monitoring risks. Internal auditors are uniquely positioned to do this because their work spans the entire organization, giving them insight into risk silos, gaps in risk ownership, and inconsistencies in risk appetite application. By communicating these observations, auditors help leaders understand why integrated ERM is superior to fragmented, departmental risk handling.

The CRMA body of knowledge distinguishes between core assurance roles, legitimate consulting roles with safeguards, and roles internal audit should not undertake. Advocating for ERM falls into the acceptable category: auditors may facilitate risk workshops, coach management on risk frameworks such as COSO ERM or ISO 31000, promote a common risk language, and recommend improvements to risk governance structures. They should not, however, set risk appetite, make risk response decisions, or own risk management processes, as these would create self-review threats.

Effective advocacy also involves providing assurance on the maturity and effectiveness of ERM processes, offering independent opinions on whether key risks are managed within appetite, and reporting on risk culture. When auditors demonstrate how ERM improves strategic decision-making, resource allocation, and resilience, they build organizational commitment.

Ultimately, advocating for ERM reinforces internal audit's role as a trusted advisor, strengthening governance while upholding the independence and objectivity demanded by professional standards.

Within the Certification in Risk Management Assurance (CRMA) framework, improving existing risk management processes is a core expectation of internal audit, flowing directly from the IIA's International Professional Practices Framework and the Global Internal Audit Standards. Internal audit's role is not simply to confirm that a risk management process exists, but to evaluate its effectiveness and offer insight that strengthens it over time.

Improvement begins with assessing the maturity of the current framework. Internal auditors examine whether risk appetite and tolerance are clearly articulated by the board, whether risk identification is comprehensive and forward-looking, whether assessment methodologies are consistently applied, and whether responses and controls genuinely mitigate exposures. Gaps between the designed process and actual practice are highlighted through assurance engagements and root-cause analysis.

Internal audit adds value by benchmarking against recognized frameworks such as COSO ERM or ISO 31000, identifying weaknesses in governance structures, reporting lines, and risk culture. Recommendations may address improving risk data quality, integrating risk discussions into strategic planning, enhancing key risk indicators, and aligning the Three Lines Model so that management ownership, oversight functions, and independent assurance are clearly delineated.

Critically, the CRMA emphasizes independence and objectivity. Internal audit may facilitate workshops, champion ERM, and advise on improvements, but it must not set risk appetite, make risk response decisions, or assume management's accountability. Safeguards such as board approval of consulting roles and periodic reassessment of independence protect this boundary.

Finally, improvement is iterative. Internal audit monitors the implementation of agreed actions, reassesses residual risk, and reports progress to the audit committee. By providing an evidence-based, independent perspective, internal audit helps the organization evolve from reactive, compliance-driven risk management toward an integrated, proactive capability that supports strategic objectives and builds stakeholder confidence.

The Three Lines Model, published by The Institute of Internal Auditors (IIA) in 2020 as an update to the earlier 'Three Lines of Defense,' is a framework that clarifies how governance, risk management, and internal audit roles work together to help an organization achieve its objectives. For CRMA candidates and internal auditors, it is foundational because it defines where assurance and advisory responsibilities sit.

The model identifies key participants: the governing body (board), management, and internal audit, with external assurance providers acting outside the organization.

The governing body holds ultimate accountability to stakeholders. It sets organizational direction, establishes risk appetite, oversees management, and ensures an independent, competent internal audit function exists.

First line roles belong to operational management. These managers own and manage risks directly, deliver products and services, and maintain day-to-day controls while remaining accountable for results.

Second line roles also sit within management but provide expertise, support, monitoring, and challenge on risk-related matters. Examples include risk management, compliance, quality, information security, and finance functions. They help build effective risk management and control frameworks and report on risk status, but they are not independent of management.

Third line roles are performed by internal audit, which provides independent and objective assurance and advice on the adequacy and effectiveness of governance and risk management. Internal audit achieves this independence through accountability to the governing body, unrestricted access to people, resources, and data, and freedom from management responsibilities and conflicts of interest.

The 2020 revision emphasizes principles rather than rigid structures: roles should be flexible, collaboration and communication among all lines are essential, and the focus should extend beyond defending against risk to creating and protecting value. Internal audit may also coordinate with second line functions and external auditors to provide combined assurance, while ensuring the governing body receives a reliable, holistic view of risk and control effectiveness across the organization.

Coordinating assurance across providers is a core competency within the Certification in Risk Management Assurance (CRMA) body of knowledge and a defined responsibility of internal audit under the IIA's Global Internal Audit Standards. Organizations receive assurance from many sources: internal audit, compliance, risk management, information security, quality functions, external auditors, and regulators. Without coordination, this creates gaps, duplicated effort, inconsistent conclusions, and 'assurance fatigue' among management. The Chief Audit Executive (CAE) is expected to build a comprehensive view of these activities so the board and senior management receive reliable, efficient, and non-overlapping assurance.

A common framework is assurance mapping. Internal audit identifies the organization's key risks and objectives, then plots which provider covers each risk, at what depth, and how frequently. The Three Lines Model helps classify providers: first-line management controls, second-line oversight functions, and third-line independent internal audit, with external assurance layered on top. The map highlights areas with excessive coverage and, more critically, areas with none.

Coordination also requires assessing the reliability of other providers before relying on their work. The CAE evaluates their independence, objectivity, competence, methodology, and quality of evidence. Where reliance is justified, internal audit can reduce its own testing and redirect resources to higher-risk areas; where it is not, internal audit retains full responsibility and documents the rationale. Importantly, the CAE remains accountable for the conclusions issued, regardless of whose work was used.

Practical mechanisms include shared risk universes, aligned terminology and rating scales, joint planning sessions, combined assurance reports, and formal protocols with external auditors to share working papers and avoid repeated inquiries of management. Reporting to the audit committee should explain the overall assurance picture rather than isolated results.

Effective coordination therefore strengthens governance, improves cost-efficiency, supports informed board oversight, and reinforces internal audit's role as the integrator of the organization's assurance landscape.

Evaluating reliance on other assurance providers is a core competency within the Certification in Risk Management Assurance (CRMA) framework and a key internal audit responsibility. Organizations typically operate with multiple layers of assurance, often described through the Three Lines Model: management controls (first line), risk management and compliance functions (second line), and internal audit (third line), supplemented by external providers such as external auditors, regulators, and specialist consultants. Internal audit must determine how much it can rely on the work of these other providers to avoid duplication, optimize resources, and present a coordinated assurance picture to the board and audit committee.

The evaluation process begins with assurance mapping, which identifies all sources of assurance across key risks and highlights gaps or overlaps. The Chief Audit Executive then assesses each provider against several criteria. Independence and objectivity are critical: a second-line function reporting to the executive it monitors offers less reliable assurance than an independent party. Competence is evaluated by reviewing qualifications, experience, and professional certifications of the provider's staff. Methodology and due professional care are judged by examining whether the provider follows a systematic, disciplined approach, with documented planning, testing, evidence, and supervision. Scope alignment ensures the provider's work actually addresses the risks and objectives relevant to the audit engagement. Finally, results and reporting are reviewed to confirm conclusions are supported by sufficient, appropriate evidence.

The IIA's Global Internal Audit Standards emphasize that internal audit retains ultimate accountability for its conclusions, even when relying on others. Therefore, auditors may need to re-perform samples of tests, review working papers, or conduct interviews to validate reliability. The degree of reliance should be proportional to the assessed quality, and any limitations must be transparently communicated to stakeholders.

Effective evaluation strengthens combined assurance, reduces assurance fatigue for management, enhances risk coverage, and ensures governing bodies receive a holistic, credible view of how well risks are managed across the enterprise.

In the Certification in Risk Management Assurance (CRMA) framework, 'Relying on External Auditors and Regulators' refers to how internal audit functions and boards can leverage the work of outside assurance providers as part of a coordinated, combined assurance model. The IIA's International Standards (notably Standard 2050 – Coordination and Reliance, and the 2024 Global Internal Audit Standards' Standard 9.5) require the chief audit executive to share information, coordinate activities, and consider relying on the work of other internal and external assurance providers to ensure proper coverage and minimize duplication of effort.

External auditors primarily provide assurance on the fairness of financial statements and the effectiveness of internal control over financial reporting. Regulators, such as banking supervisors, environmental agencies, or data-protection authorities, examine compliance with specific laws and prudential requirements. Internal audit can rely on their findings to reduce its own testing in those areas, freeing resources for operational, strategic, and emerging risks that external parties do not cover.

However, reliance must be disciplined. Before placing reliance, the CAE should evaluate the external provider's independence, objectivity, competence, scope, methodology, and the timeliness and relevance of the work to the organization's risk profile. External auditors focus on materiality to financial statements, not necessarily to operational risk, and regulators review against minimum legal thresholds rather than best practice. Therefore, their work may leave assurance gaps. The CAE retains full accountability for conclusions drawn and cannot outsource professional judgment.

From a governance perspective, the audit committee should receive an assurance map showing which risks are covered by the first line (management), second line (risk and compliance functions), third line (internal audit), and external providers. This transparency helps the board judge whether aggregate assurance is adequate.

In summary, reliance on external auditors and regulators enhances efficiency and breadth of coverage, but it must be based on documented evaluation, clear communication, and recognition that internal audit remains responsible for an independent, risk-based opinion on governance, risk management, and control.

Combined Assurance is a coordinated approach in which an organization aligns and integrates all of its assurance activities—from management, internal functions, and external providers—to give the board and audit committee a single, coherent view of how well key risks are being managed. The concept was popularized by the King III and King IV codes in South Africa and is now embedded in the IIA's Three Lines Model, which the Certification in Risk Management Assurance (CRMA) syllabus draws on heavily.

Under the Three Lines Model, the first line consists of operational management that owns and manages risks; the second line comprises functions such as risk management, compliance, quality and information security that monitor and support the first line; and the third line is internal audit, which provides independent, objective assurance to governing bodies. External assurance providers, including external auditors and regulators, sit outside these lines. Combined Assurance maps each significant risk against every assurance provider covering it, creating an 'assurance map' that reveals gaps, overlaps and duplication.

Internal audit's roles and responsibilities in this context are significant. Internal audit typically facilitates or coordinates the combined assurance process, relies on the work of other assurance providers where appropriate (in line with IIA Standard 2050 on coordination and reliance), and reports to the audit committee on the overall adequacy of assurance coverage. However, internal audit must preserve its independence; it should not take ownership of risks or perform second-line management activities without appropriate safeguards and disclosure.

The benefits include reduced assurance fatigue for the business, more efficient use of limited resources, consistent risk language and reporting, and stronger board confidence in the integrity of information used for decision-making. Challenges include differing methodologies, varying levels of provider competence and objectivity, and the need for a sound risk register as the foundation.

For CRMA candidates, understanding Combined Assurance demonstrates the ability to evaluate risk management frameworks holistically and to position internal audit as a strategic enabler of effective governance.

Building an organization-wide risk assurance map is a key practice within the Certification in Risk Management Assurance (CRMA) body of knowledge, reflecting internal audit's role in providing the board and senior management with a coordinated view of how risks are being assured across the enterprise. An assurance map is a visual tool that links the organization's significant risks to the various sources of assurance that address them, revealing gaps, duplications, and areas of over- or under-reliance.

The process begins with identifying the key risk categories, typically drawn from the enterprise risk management framework, strategic objectives, and risk appetite statements. Next, internal audit catalogues all assurance providers, often organized using the Three Lines Model: first-line management controls and self-assessments, second-line functions such as compliance, risk management, quality, health and safety, and information security, and third-line independent assurance from internal audit, external auditors, and regulators.

Each assurance activity is then plotted against the relevant risk, with attention to the scope, frequency, independence, competence, and quality of the assurance provided. Color coding or rating scales commonly indicate the level of assurance coverage. This analysis exposes risks with insufficient assurance, areas where multiple providers overlap inefficiently, and situations where assurance comes only from less independent sources.

Internal audit's responsibilities include facilitating the exercise, validating the reliability of other providers' work before placing reliance on it, and reporting conclusions to the audit committee. The map informs the risk-based audit plan, supports combined assurance strategies, and helps the board fulfill its governance oversight obligations under standards such as the IIA's Global Internal Audit Standards.

An effective assurance map must be dynamic, refreshed as the risk profile evolves, and owned collaboratively rather than treated solely as an internal audit document. Done well, it optimizes assurance resources, reduces assurance fatigue for management, strengthens accountability, and enhances the organization's overall confidence that its most significant risks are adequately understood, controlled, and independently reviewed.

An assurance map is a visual tool that plots an organization's key risks against the assurance activities performed over them, typically organized by the Three Lines Model: management controls (first line), risk management and compliance functions (second line), and internal audit (third line), plus external providers such as external auditors and regulators. In the context of the Certification in Risk Management Assurance (CRMA) and internal audit roles, the map is central to coordinating assurance so the board and audit committee understand how much comfort they actually have over significant risks.

Finding gaps involves identifying risks that receive little or no assurance coverage. When building the map, internal audit lists the organization's principal risks or auditable units and records who provides assurance over each, how often, and at what depth. Cells with no provider, or only self-assessment by management, indicate potential gaps. These may represent emerging risks, areas outside any function's mandate, or activities assumed to be covered by someone else. Gaps are prioritized by risk significance; high-impact risks with weak coverage become candidates for internal audit plan additions or for assigning responsibility to a second-line function.

Finding overlaps involves spotting risks reviewed by several providers with similar scope and frequency, causing duplicated effort, audit fatigue for operational staff, and wasted resources. Overlaps are not always bad, as some risks warrant multiple layers, but unnecessary duplication should be rationalized by sharing results, relying on another provider's work after assessing its competence and objectivity, or adjusting coverage timing.

The chief audit executive uses the completed map to refine the risk-based audit plan, communicate total assurance to the audit committee, and support combined or integrated assurance. The map should be refreshed periodically as risks and assurance providers change. For CRMA candidates, the key insight is that the assurance map enables internal audit to allocate scarce resources efficiently while ensuring governance bodies receive balanced, reliable assurance across the full risk universe.

Maintaining and updating the assurance map is a continuous responsibility within the Certification in Risk Management Assurance (CRMA) framework and a core element of internal audit's coordinating role. An assurance map is a visual and analytical tool that links an organization's key risks to the assurance providers across the three lines: management controls (first line), risk, compliance and other oversight functions (second line), and internal audit (third line), supplemented by external assurance such as external auditors and regulators. Because risks, structures and assurance activities change constantly, a static map quickly loses relevance, so it must be treated as a living document.

Internal audit typically acts as the custodian or facilitator of the map, even though ownership of the underlying risks rests with management. Maintenance begins with periodic refreshes of the risk universe, usually aligned with the enterprise risk management cycle and the annual audit planning process. New or emerging risks, such as cyber threats, ESG obligations or regulatory changes, are added, while obsolete risks are retired. Each risk's inherent and residual ratings are revalidated with risk owners.

Next, assurance coverage is reassessed. Auditors confirm which functions are actually providing assurance over each risk, the nature and depth of that assurance, its frequency and the reliability of the provider. Changes in organizational structure, outsourcing arrangements or new second-line functions must be reflected. This analysis exposes gaps where critical risks receive insufficient assurance and overlaps where duplicated effort wastes resources, allowing the chief audit executive to rebalance the audit plan and recommend adjustments to management.

Updates should be documented with version control, approved through governance channels and reported to the audit committee, which relies on the map to form a holistic view of assurance. Regular dialogue with assurance providers, clear ownership, and integration with risk registers and audit management systems ensure the map remains accurate, credible and useful for decision-making.