Which of the following actions should the internal audit activity take during an audit engagement when examining the effectiveness of risk management…

Question breakdown

Tests

Apply internal audit's responsibilities when evaluating risk management

Difficulty

Medium

Key idea: When evaluating risk management effectiveness, internal auditors must assess how the organization identifies and manages fraud risk.

How to reach the answer

1. The question concerns what auditors do when they examine the effectiveness of risk management processes.
2. The Standards explicitly require evaluating the potential for fraud and how the organization manages fraud risk.
3. Establishing improvement procedures is a management task and would impair objectivity.
4. Industry standards are not the required benchmark, and aligning objectives verifies strategy alignment rather than how risk is managed.

Each option

• ACorrect. Assessing fraud risk management is an explicit expectation when internal audit evaluates risk management.
• BIncorrect. Designing or establishing risk management procedures is a management responsibility, not an assurance activity.
• CIncorrect. Risk responses should be aligned with the organization's own risk appetite, not necessarily with industry standards, and 'ensure' implies management ownership.
• DIncorrect. Auditors assess whether objectives support and align with the mission, but checking department-level alignment is not the focus of a risk management effectiveness evaluation.

Common trap: Option D echoes a real evaluation point about objectives supporting the mission, so it sounds like a requirement even though it misstates the scope.

In practice: Auditors of ERM programs check whether fraud risk assessments exist, are refreshed regularly, and lead to anti-fraud controls.

Remember: Evaluating risk management always includes evaluating fraud risk management.

Drafted with AI assistance and checked against the answer key.