According to the International Professional Practices Framework, internal auditors who are assessing the adequacy of...

Recognize that organizations use different techniques for managing risk.

Seek assurance that the key objectives of the risk management processes are being met.

Determine and accept the level of risk for the organization.

Treat the evaluation of risk management processes differently from the risk analysis used to plan audit engagements.