Which of the following statements is true regarding the role of the internal audit activity in the organization’s risk management process?
A.
The internal audit activity should not be responsible for developing the organization’s risk management framework, even with appropriate safeguards.
B.
The internal audit activity is typically responsible for alerting operational management to emerging risks and changes in regulatory scenarios.
C.
The internal audit activity may coach management on risk response scenarios if safeguards have been implemented.
D.
The internal audit activity should avoid giving assurance regarding the accuracy of risk evaluations if safeguards have not been implemented.
According to IIA Standards and Position Papers on internal audit's role in risk management:
Internal auditors can take on advisory or consulting roles, such as coaching management on risk response, provided:
-The activity does not involve making decisions for management.
-Appropriate safeguards (e.g., clear boundaries, documentation) are in place to maintain independence and objectivity.
Coaching, facilitating workshops, or advising on risk scenarios are allowed forms of consulting under these conditions.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Kozy
1 week, 3 days ago