Internal Audit Roles and Responsibilities

In the context of the Certification in Risk Management Assurance (CRMA), internal audit's roles and responsibilities center on providing independent, objective assurance and advisory services over governance, risk management, and control processes. The CRMA emphasizes that internal audit must understand the organization's risk management framework and evaluate whether it is designed and operating effectively to support achievement of strategic objectives. Core assurance roles include: giving assurance on risk management processes; giving assurance that key risks are correctly evaluated; evaluating risk management processes; evaluating the reporting of key risks; and reviewing the management of key risks. These activities are considered legitimate because they preserve internal audit's independence and objectivity, as described in the IIA's position paper on the role of internal auditing in enterprise-wide risk management (ERM) and the Three Lines Model. Consulting or advisory roles, performed with appropriate safeguards, include facilitating identification and evaluation of risks, coaching management on responding to risks, coordinating ERM activities, consolidating risk reporting, maintaining and developing the ERM framework, championing ERM establishment, and developing risk management strategy for board approval. Internal audit may perform these only if management retains responsibility for decisions and the nature of the work is disclosed to the board. Roles internal audit should not undertake include setting the risk appetite, imposing risk management processes, providing management assurance on risks, taking decisions on risk responses, implementing responses on management's behalf, or holding accountability for risk management. Performing these would compromise independence, as internal audit would be auditing its own work. Additionally, the chief audit executive is responsible for developing a risk-based audit plan aligned with organizational risk assessments, communicating risk and control information to senior management and the board, reporting on the adequacy of risk management, and coordinating with other assurance providers to ensure comprehensive coverage and minimize duplication. These responsibilities are governed by the IIA's Global Internal Audit Standards, which require conformance, due professional care, and ongoing quality assurance. In the context of the Certification in Risk Management Assurance (CRMA), internal audit's roles and responsibilities center on providing independent, objective assurance and advisory services over governance, risk management, and control processes. The CRMA emphasizes that internal audit must under…