According to MA guidance, which of the following is an appropriate role for the internal audit activity?

According to the Institute of Internal Auditors (IIA) guidance, the internal audit activity can provide advisory and consulting services to improve an organization's governance, risk management, and control processes. Coaching management in responding to risks is a legitimate consulting role. This role helps management improve their capabilities without internal audit assuming management's responsibility for managing risk. To maintain objectivity, the nature of such consulting services must be defined in the internal audit charter, and internal audit must not make management decisions or implement the responses themselves. This advisory stance supports management while preserving the internal audit activity's independence.

B. Implementing risk responses on management's behalf. This is a management function. Performing it would impair internal audit's independence and objectivity, as they would be auditing their own work.
C. Imposing risk management processes. Designing and imposing risk management processes is management's responsibility. Internal audit's role is to evaluate these processes, not to create or enforce them.
D. Setting the risk appetite. This is a strategic responsibility of senior management and the board. Internal audit lacks the authority and undertaking this role would be a severe impairment of independence.

1. The Institute of Internal Auditors (IIA), International Professional Practices Framework (IPPF), Standard 2120: Risk Management. The standard states, "The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes." The associated Implementation Guide clarifies the specific roles.

2. The Institute of Internal Auditors (IIA), Implementation Guide 2120: Risk Management (July 2020). This guide provides a table clarifying roles. It explicitly lists "Coaching management in responding to risks" under "Legitimate internal audit roles with safeguards" (p. 6). Conversely, it lists "Setting the risk appetite," "Imposing risk management processes," and "Implementing risk responses on management’s behalf" under "Roles internal audit should not undertake" (p. 7).

3. The Institute of Internal Auditors (IIA), Position Paper, "The IIA's Three Lines Model" (July 2020). This paper clarifies that management (first and second lines) is responsible for managing risk, while internal audit (third line) provides independent and objective assurance and advice. Taking on management roles like implementing responses or setting appetite would violate this core principle of independence (p. 4, Principle 6).

4. Anderson, U. L., Head, M. J., Ramamoorti, S., Riddle, C., & Salamasick, M. (2017). Internal Auditing: Assurance & Advisory Services (4th ed.). The Institute of Internal Auditors Research Foundation. Chapter 6, "Introduction to Risk Management," discusses the appropriate roles for internal audit in ERM, aligning with IIA guidance that advisory roles like coaching are acceptable, while management roles like implementing responses are not (pp. 180-181).