Section 1: Internal Audit Roles and Responsibilities

Roles and Competencies

Balancing the Dual Mandate: Appropriate IA Services for Risk Management

In today’s business landscape, volatility is the new normal. Organizations face a torrent of complex, interconnected risks, from global supply chain disruptions and sophisticated cyber-attacks to sudden regulatory shifts and the existential questions of climate change. In this environment, effective risk management is not just a compliance exercise; it is a core strategic competency. It is the mechanism that allows an organization to navigate uncertainty, protect its value, and seize new opportunities.

Within this high-stakes arena, the Internal Audit (IA) function is uniquely positioned. It holds an enterprise-wide view, reports directly to the board's audit committee, and is (or should be) staffed with professionals skilled in process, risk, and control. This position, however, presents a fundamental challenge. The board and stakeholders demand objective assurance—an independent,"cold-eyes" review of whether the company’s risk management processes are working. At the same time, management and the executive team crave practical consulting—forward-looking advice and partnership to help them build and improve those very processes.

This is the dual mandate of modern Internal Audit. It is a delicate, essential balance between being the independent auditor and the trusted advisor. The key to success is not choosing one role over the other, but skillfully determining the appropriate services for each, without ever compromising the independence that serves as the function's bedrock. This paper will explore this dual role, defining the specific, appropriate, and value-added services Internal Audit can—and should—provide for risk management.

The Foundation: Understanding the Dual Mandate

Before we can define"appropriate services," we must first clarify our terms. The Institute of Internal Auditors (IIA) formally defines internal auditing as"an independent, objective assurance and consulting activity designed to add value and improve an organization's operations." The definition itself bakes in this dual mandate.

Risk management, particularly Enterprise Risk Management (ERM), is the formal process management uses to identify, assess, respond to, and monitor risks to achieve its objectives. It’s management's job to own this process, full stop.

The central tension lives in one non-negotiable principle: objectivity. Internal Audit's primary value to the board is its independence. If IA becomes responsible for managing risk, it can no longer provide objective assurance over it. This would be like a student grading their own exam.

So, we must view all services through these two distinct lenses:

Assurance Services: These involve an objective assessment of evidence to provide an independent opinion or conclusion. The core question for assurance is:"Is our risk management process designed correctly and working as intended?" This is often a look-back or a current-state review.

Consulting Services: These are advisory in nature and are generally performed at the specific request of management. The key is that management retains full ownership of the outcome. The core question for consulting is:"How can we improve our risk management process?" This is forward-looking and collaborative.

From a"lived experience" perspective, this is the daily tightrope a Chief Audit Executive (CAE) walks. The Audit Committee Chair calls and asks,"I want your independent assurance that management’s new cybersecurity risk program is effective." An hour later, the Chief Information Security Officer (CISO) calls and says,"I'm building that new cyber program and I’d value your team’s advice on best practices for control design." The CAE must serve both masters, and the answer to both is,"Yes." It's all in how it's done.

The Auditor's Lens: Appropriate Assurance Services on Risk Management

Assurance is Internal Audit's home turf. When it comes to risk management, IA should provide assurance over the process, not over the risks themselves. (IA does not, for example, opine on"whether our credit risk is at the right level." It opines on"whether the process for identifying, measuring, and reporting credit risk is effective.")

Here are the primary, appropriate assurance services IA should provide:

1. Auditing the Risk Management Framework (Design Adequacy)

This is a fundamental audit. IA assesses the design of the ERM framework itself, long before looking at any specific risks.

What it is: IA reviews the organization's chosen framework (e.g., COSO ERM, ISO 31000) and compares it to the company's size, complexity, and strategic goals.

Key Questions: Is the framework comprehensive? Does it clearly define roles and responsibilities? Does it cover all relevant risk categories (strategic, operational, financial, compliance)? Is the"risk appetite statement" approved by the board clear and communicated effectively?

Case Study Example: IA at a rapidly growing financial technology (fintech) company performed a"design adequacy" review of its ERM program. The program was copied from the CEO's prior firm, a traditional, slow-moving insurance company. The audit finding was clear: the framework's design was inadequate. It was too bureaucratic, focused on financial and compliance risks, and almost completely ignored the company's primary strategic risks: speed of innovation, talent retention, and platform scalability. This assurance