ERM Build-Out: Consulting Help or Assurance Self-Review?

Accepting the full package as described creates a self-review threat: internal audit would design the taxonomy, populate the register, and then opine on the ERM framework’s effectiveness in the same year. Drafting the taxonomy and deciding what belongs in the register are management responsibilities, not assurance work. Facilitating workshops can be consulting, but only if management owns the decisions and outputs. The CAE should decline ownership of the register. If advisory support proceeds, safeguards should include a written consulting engagement letter, explicit management ownership of risk decisions, separate teams for consulting and assurance, audit committee approval, disclosure of the impairment, and either postponing the ERM assurance engagement or using an independent reviewer. The CRO reviewing internal audit’s draft register does not cure the self-review problem; it adds reciprocal review. The CAE should state that year-end assurance may be limited to operating effectiveness after management has run the process for a sufficient period.

The CAE should distinguish consulting from assurance. Internal audit can advise on ERM process design, facilitate management workshops, and provide tools, but it should not make risk decisions or own the register. Accepting ownership would impair the ability to give independent assurance, and the impairment cannot be fully mitigated by having the CRO review the work. The CAE should propose a sequenced approach: advisory support in the first half of the year with clear role boundaries; management operates the refreshed process for at least one cycle; a separate internal audit team then assesses design and operating effectiveness, with the consulting engagement disclosed. If the committee insists on year-end assurance, internal audit should not draft the taxonomy or populate the register. The charter should be updated to define ERM roles and consulting safeguards. The chair should also understand that a year-end opinion may be qualified if the process has not operated long enough to test.

The report should disclose that internal audit performed a consulting engagement covering the ERM refresh, including taxonomy drafting or workshop facilitation, and that this creates a self-review threat. The assurance conclusion should state that it does not cover the adequacy of the taxonomy or register content that internal audit helped design. The scope should be limited to whether management operated the process as designed after adoption, supported by evidence such as workshop attendance, risk owner sign-offs, and decision logs. The report should note reliance on management representations and any inability to test design independently. It should identify the safeguards applied, including separate engagement teams and audit committee oversight. If the impairment is significant, the CAE should state that an independent party should perform the design assessment. The report should avoid implying a clean opinion on ERM as a whole when internal audit helped build the framework.