Which of the following statements is true regarding the role of the internal audit activity in the organization's risk management process?

Question

Options

• AThe internal audit activity should not be responsible for developing the organization's risk
• BThe internal audit activity is typically responsible for alerting operational management to
• CThe internal audit activity may coach management on risk response scenarios if safeguards have
• DThe internal audit activity should avoid giving assurance regarding the accuracy of risk evaluations

• A
  4% (2)
• B
  13% (7)
• C
  73% (38)
• D
  10% (5)

Explanation

Option C reflects the IIA's distinction between core and consulting roles for internal audit in risk management. Coaching management on risk response scenarios is a legitimate consulting activity - provided safeguards (such as not taking ownership of decisions or the process) are in place to preserve the auditor's objectivity and independence.

Why the distractors are wrong:

• A is too restrictive: Internal audit can help facilitate or develop risk processes in a consulting capacity; the prohibition is on owning or being accountable for those processes, not participating in them at all.
• B is wrong because alerting operational management to emerging risks is a management responsibility - internal audit provides assurance and consulting, not day-to-day operational risk monitoring.
• D is the opposite of IIA guidance: evaluating whether risks are correctly assessed and providing assurance on the accuracy of risk evaluations is actually one of internal audit's core legitimate roles.

Memory tip: Think of internal audit as a "coach, not a player." They can coach management (consulting role, with safeguards), but they must never pick up the ball and run with it - no owning risk appetite, no implementing responses, no making risk decisions.

No community discussion yet for this question.