How should a chief audit executive learn about emerging risk areas in an organization?

Emerging risks are often not yet captured in formal risk registers or assessment procedures. The most effective way for a chief audit executive (CAE) to learn about these new and evolving risks is through continuous and open communication with management. By building and maintaining a strong collaborative network, the CAE can participate in strategic discussions and stay informed about new initiatives, changing market conditions, and operational challenges in real-time. This proactive engagement provides forward-looking insights that are essential for identifying emerging risks early.

B. Building the risk management process is a management responsibility; the CAE's role is to provide assurance on its effectiveness.
C. Reviewing past procedures is a reactive approach and is unlikely to identify new, emerging risks not previously considered.
D. Reviewing the risk appetite framework provides context for risk evaluation but does not, by itself, identify new risks.

1. The Institute of Internal Auditors (IIA). (2020). Practice Guide: Auditing Risk Management. The guide emphasizes the importance of internal audit's communication with management and the board to understand the business and its evolving risk landscape.

2. The Institute of Internal Auditors (IIA). (2021). OnRisk 2022: A Guide to Understanding, Aligning, and Optimizing Risk. This report highlights that strong communication and collaboration among the three lines (management, risk functions, and internal audit) are critical for effective risk identification and management, including for emerging risks.