According to the International Professional Practices Framework, internal auditors who are assessing the adequacy of organizational risk management processes should not:

According to the International Professional Practices Framework (IPPF), the internal audit activity's role is to evaluate the effectiveness of and contribute to the improvement of risk management processes. However, setting the organization's risk appetite and accepting specific levels of risk are fundamental responsibilities of management and the board. If internal auditors were to determine and accept risk levels, it would constitute a management function, thereby impairing their independence and objectivity, which are cornerstones of the internal audit profession as defined by the IIA Standards.

A. Auditors must recognize that risk management frameworks are not one-size-fits-all and should be tailored to the specific organization's context.
B. Seeking assurance that risk management objectives are met is the core purpose of an internal audit of the risk management process, as mandated by Standard 2120.
D. These are two distinct activities; one is an assurance engagement over the organization's risk management, while the other is the internal audit function's own risk-based planning process.

1. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards). Standard 2120 – Risk Management. "The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes." This defines the auditor's role as evaluation, not decision-making.

2. The Institute of Internal Auditors (IIA). (2017). Implementation Guide 2120: Risk Management. Paragraph on "Roles and Responsibilities." It clarifies, "Determining the organization’s risk appetite is a responsibility of senior management and the board... The internal audit activity should not manage any of the risks on behalf of the organization, make risk management decisions, or take on the responsibilities of management." This directly supports that option C is a prohibited activity.

3. The Institute of Internal Auditors (IIA). (2020). The IIA’s Three Lines Model. Page 4, "Key Roles in the Three Lines Model." This model explicitly places risk ownership and decision-making with management (first and second lines) and independent assurance with internal audit (third line), reinforcing the necessary separation of duties.