IIA IIA-CIA-Part1 Online Access

The most appropriate role for internal audit in an organization ' s risk management process is reporting to the board on management ' s assessment of current risks. This role involves providing assurance on the effectiveness of the organization ' s risk management processes, including the accuracy and effectiveness of management ' s risk assessment. Internal audit should not be directly involved in establishing risk management frameworks or developing controls, as these are management responsibilities.

The Institute of Internal Auditors (IIA) - Standards and Guidance on Risk Management

Internal auditors can indeed provide assurance on reported sustainability results. This involves evaluating the accuracy and completeness of an organization ' s sustainability reporting and verifying that the reported information reflects actual performance. This role aligns with the broader assurance and advisory functions of internal audit, ensuring that CSR disclosures are reliable and credible.

The Institute of Internal Auditors (IIA) Standards and Practice Advisories.

Global Reporting Initiative (GRI) Standards.

" Internal Auditing: Assurance & Advisory Services " by IIA, Chapter on CSR and Sustainability Reporting.

When evaluating whether management has selected appropriate risk responses, an internal auditor should consider the organization ' s risk appetite—the amount and type of risk that an organization is prepared to pursue, retain, or take. Risk appetite sets the boundaries within which risk responses should be formulated. Risk tolerance and capacity are related concepts, but risk appetite is a more direct measure of whether a particular risk response aligns with organizational goals and strategy.

Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing

To help establish the authority of the internal audit activity, an internal audit charter should document the chief audit executive’s (CAE ' s) reporting line. This information clarifies the CAE ' s position within the organization, reinforces their independence, and underscores the authority granted to them by the board, which is crucial for enabling the internal audit activity to fulfill its mandate effectively.

IIA Standard 1110 - Organizational Independence, which emphasizes the importance of defining the CAE’s reporting lines in the internal audit charter to ensure organizational independence.