An organization does not have a formal risk management function. According to the Standards, which of the following are conditions where the internal audit activity (IAA) may provide risk management consulting? 1. There is a clear strategy and timeline to migrate risk management responsibility back to management. 2. The IAA has the final approval on any risk management decisions. 3. The IAA does not give objective assurance on any part of the risk management framework for which it is responsible. 4. The nature of services provided to the organization is documented in the internal audit charter.

Question

Quizplus · Accepted Answer

The IAA can provide risk management consulting if there is a strategy to return responsibility to management, it does not provide assurance on areas it manages, and services are documented in the audit charter.

An Organization Does Not Have a Formal Risk Management Function