The chief risk officer (CRO) requested the internal audit function’s assistance during the implementation of...

Facilitating risk self-assessment workshops is an appropriate advisory role for internal audit because it helps management identify and evaluate risks while leaving ownership and decision-making with management. Internal auditors can provide methodology, facilitation skills, and risk knowledge without assuming responsibility for managing the organization’s risks. Creating and maintaining the entire risk management framework could place internal audit in an ongoing management role. Internal audit also should not use assurance engagements to enforce management compliance, because assurance evaluates rather than manages risk processes. Determining appropriate risk responses is clearly a management responsibility because management must decide whether risks should be accepted, reduced, shared, or avoided. Therefore, facilitating structured self-assessment workshops provides useful assistance while preserving internal audit’s independence and future ability to provide objective assurance.