Governance, Risk Management, and Control
Governance
Governance is the combination of processes and structures implemented by the board to inform, direct, manage and monitor the organization's activities toward its objectives. The board sets risk appetite and provides oversight; senior management executes. The three lines model divides responsibilities: management owns and manages risk in the first line, risk and compliance functions monitor and advise in the second, and internal audit gives independent assurance in the third. Internal audit evaluates and recommends improvements to governance; it does not run it.
Risk management
Know inherent risk (before controls) versus residual risk (after controls), risk appetite versus risk tolerance, and the responses: avoid, reduce, share, accept. Internal audit evaluates the design and operating effectiveness of risk management and reports on it; it must not choose the risk treatment or become a risk owner. Consulting can help build risk awareness or facilitate a workshop if objectivity is safeguarded, but implementing the framework belongs to management.
Control
A control is any action taken by management to manage risk and increase the likelihood that objectives are met. COSO Internal Control has five components: control environment, risk assessment, control activities, information and communication, and monitoring. COSO ERM and ISO 31000 address risk management. Classify controls as preventive, detective, directive or corrective, and distinguish hard controls (policies, approvals) from soft controls (tone at the top, ethical culture).
Worked example
An exception report reconciled monthly by the accounting manager is a detective control; a system rule blocking payments above a limit is preventive. In both cases management owns the control; internal audit only assesses it.
Traps
Treating internal audit as a control or as a second-line function; assuming more controls is always better (over-control costs money); auditing paperwork instead of whether the process meets its objectives.