Which of the following is PRIMARILY responsible for providing assurance to the board of directors and senior management during the evaluation of a risk management program implementation?

The risk management function *manages* the program, identifying and treating risks, but internal audit provides the independent *assurance* that the program is effective.

Business units are stakeholders and are responsible for implementing risk responses, but they do not provide independent assurance over the entire risk management program's effectiveness.

External audit provides assurance on financial statements or specific compliance requirements, often on an annual basis, whereas internal audit provides ongoing, internal operational assurance across all business processes, including risk management.

Internal audit's core function is to provide independent and objective assurance and consulting services designed to add value and improve an organization's operations, including the effectiveness of its governance, risk management, and control processes. They are uniquely positioned to assess the implementation and effectiveness of the risk management program and report findings directly to the board and senior management.