The board, senior management, and the chief audit executive (CAE) discussed that the CAE will...

When the CAE has ongoing responsibility for the risk management function, internal audit cannot independently provide assurance over that activity without safeguards because the function would effectively be evaluating work under the CAE’s own responsibility. The appropriate response is for the board to establish an alternative method of obtaining objective assurance, such as using an independent internal or external assurance provider. Simply acknowledging the arrangement does not eliminate the impairment. Changing the organizational level of the risk management function also does not resolve the CAE’s conflicting responsibilities. The arrangement itself may be accepted temporarily when properly authorized, but safeguards are necessary to protect the credibility of assurance work. Therefore, the board should establish alternative assurance processes for the risk management function while the CAE retains that responsibility.