Which of the following is an appropriate role for the internal audit activity?

The primary role of the internal audit activity is to provide independent and objective assurance and consulting services. According to the Institute of Internal Auditors (IIA) Standards, the internal audit activity must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement. This "assisting" role is fulfilled through evaluation, advice, and recommendations, which helps management fulfill its responsibility for controls without the internal audit activity assuming management's duties. This maintains the crucial elements of independence and objectivity required for the internal audit function.

A. "Ensuring" that risks are managed is a direct responsibility of management, not internal audit. Internal audit provides assurance on the effectiveness of management's risk management processes.
C. "Implementing" new controls is a management function. If internal audit implements controls, it cannot objectively audit them later, which would be a severe impairment of its independence.
D. Internal audit coordinates with external auditors but does not "validate" their work. Each has distinct responsibilities and reports to different stakeholders, although they may rely on each other's work to improve efficiency.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing. Standard 2130 – Control.

The standard explicitly states: "The internal audit activity must assist the organization in maintaining effective controls by evaluating their effectiveness and efficiency and by promoting continuous improvement." This directly supports option B.

2. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing. Definition of Internal Auditing.

The definition states internal auditing is an "independent, objective assurance and consulting activity... It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes." This supports the "assisting" and "improving" role, while the "independent, objective" nature precludes management functions like "ensuring" (A) and "implementing" (C).

3. Pickett, K. H. S. (2019). The Internal Auditing Handbook (4th ed.). Wiley. Chapter 2, The Internal Audit Role.

This academic text clarifies that "Internal audit is not responsible for implementing its recommendations... Management is responsible for deciding what action to take in response to reported audit findings." (paraphrased from discussion on audit roles). This directly refutes option C.

4. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing. Standard 1100 – Independence and Objectivity.

This standard emphasizes that the internal audit activity must be free from interference in determining the scope of internal auditing, performing work, and communicating results. Taking on management responsibilities such as implementing or ensuring controls would directly violate this standard.