According to MA guidance, which of the following is an appropriate role for the internal audit activity?

Question

Options

• ACoaching management in responding to risks.
• BImplementing risk responses on management's behalf.
• CImposing risk management processes.
• DSetting the risk appetite.

• A
  72% (21)
• B
  14% (4)
• C
  3% (1)
• D
  10% (3)

Explanation

Coaching management in responding to risks (A) is correct because internal audit's advisory role allows it to guide, educate, and support management without assuming ownership of the risk management process - preserving independence and objectivity.

Why the distractors fail:

• B (Implementing risk responses) - Executing management's responsibilities crosses into an operational role, which would impair internal audit's independence and create a self-review threat.
• C (Imposing processes) - Internal audit advises; it has no authority to mandate or force risk management practices onto the organization.
• D (Setting risk appetite) - Risk appetite is a governance-level decision belonging to the board and senior management, not internal audit.

Memory tip: Think of internal audit as a coach on the sideline, not a player on the field. It can advise, train, and guide (coaching) but cannot make the plays (implement, impose, or set strategy) - otherwise it loses its independence to later audit those same activities.

No community discussion yet for this question.