Taking Over the Risk Register

No - not without creating a self-review impairment that also damages the activity's credibility.

• Assigning risk owners is a management decision. It allocates accountability and resources. Internal audit has no authority to bind operating managers, and doing so converts audit findings into audit-made policy.
• Maintaining the register puts internal audit in the position of curating the risk data it will later use to build the audit plan and to opine on risk management. If a risk is missed in the register, internal audit is evaluating its own omission.
• The savings argument is not an argument. The $180,000 is the price of a management function, not of an audit function. Replacing a consultant with internal audit does not eliminate the role; it just moves management work into an activity whose value depends on not doing management work.

What internal audit can do: provide assurance on the ERM process, facilitate risk workshops using management's content, advise on framework design (ISO 31000, COSO ERM), and challenge the register's completeness through its own audit work. The CAE should state plainly that ERM's second-line coordination function belongs in management - ideally an independent risk officer - not in internal audit.

Several overlapping weaknesses; the composition point is the sharpest.

• Committee composition. Three physicians with admitting privileges are not independent of management - their income and privileges depend on the organization. A supplier's CEO is similarly conflicted on procurement and contract matters. Only three of seven are independent, which does not give the committee an independent majority for oversight of internal audit, external audit, and ERM. Independence of the committee is the board's problem, not the CAE's to fix, but the CAE must report it.
• Combined audit-and-finance mandate. Audit committees that also own finance spend their time on financial performance and have limited capacity for risk oversight. Evidence here: 214 risks, 60% unowned - a register that has never been worked.
• CFO coordinating ERM. The CFO is a first-line operator with the largest budget and the strongest incentive to understate certain risks; making the CFO the coordinator means the entity's principal risk aggregator reports through the function most exposed to those risks. It also means internal audit's ERM assurance would be directed at its own administrative reporting line.
• The appetite statement. 'Low tolerance for risk' is not an appetite. It gives no measurable boundary and cannot be used to make a decision, which is consistent with a register nobody owns.

Recommendations, in priority order:

1. Decline the ERM administration role in writing, with the reasoning stated, and offer the alternative: assurance and advisory support delivered from outside the process. Declining is not obstruction - it preserves the only independent view the committee has.
2. Move ERM coordination to an independent risk function reporting to the CEO or the board risk committee, with authority to assign owners. If a full-time role is not feasible, a management risk committee chaired by the CEO can assign owners; the CFO can be a member, not the chair.
3. Fix the register before expanding it. 214 risks with 60% unowned is not a register. Recommend a top-20 risk list, each with a named owner, a tolerance, and a reporting cadence, before any further population.
4. Rewrite the appetite statement into measurable tolerances by risk category - this is management's and the board's work, with internal audit advising.
5. Restructure the committee toward an independent majority and a separate risk committee, or at minimum recuse conflicted members from audit and risk items.

Internal audit's own role: deliver a first assurance engagement on ERM design once owners exist, and report to the committee that until then, any opinion on ERM effectiveness would be unsupportable. The CAE should also disclose in the committee minutes the pressure to absorb an unfunded management function.