How should an internal auditor approach preparing a detailed risk assessment during engagement planning?

When preparing a detailed risk assessment during engagement planning, the internal auditor should collaborate with the management of the function being reviewed. Management has the most in-depth knowledge of their business objectives, processes, and the associated risks. This cooperation ensures that the risk assessment is comprehensive, accurate, and relevant to the specific context of the function under review. It also helps in identifying any potential areas of concern that might not be evident to external parties.

IIA Standard 2201: "Planning Considerations"

IIA Practice Guide: "Assessing the Adequacy of Risk Management Processes"