IIA CRMA cheat sheet

Three lines model: first line owns and manages risk (operating management); second line provides independent oversight, monitoring, and challenge (risk, compliance, quality); third line is internal audit, which provides independent assurance to the governing body on the effectiveness of risk management and control.

The three lines are roles, not organizational boxes: a single individual may perform first- and second-line work, but internal audit must not assume first- or second-line responsibilities, because doing so impairs the objectivity required for assurance.

CRMA assurance engagements evaluate whether the organization's risk management framework is designed and operating effectively; consulting engagements advise without asserting effectiveness. The distinction determines whether a conclusion/opinion is expressed.

COSO ERM components: governance and culture; strategy and objective-setting; performance; review and revision; information, communication, and reporting. Assurance work maps evidence to these components and to the underlying principles.

ISO 31000 process steps: establishing scope, context, and criteria; risk identification; risk analysis; risk evaluation; risk treatment; communication and consultation; monitoring and review. These run continuously, not as a one-time sequence.

Risk appetite is the amount and type of risk the organization is willing to accept in pursuit of objectives; risk tolerance is the acceptable variation in performance around a specific objective. A framework without a defined appetite cannot be tested for alignment.

Risk criteria are the thresholds an organization uses to evaluate significance of risk (likelihood, impact, velocity, aggregation). Assurance tests whether criteria are defined, approved by the governing body, and applied consistently across the enterprise.

Board and audit committee oversight: the governing body approves risk appetite and framework, receives assurance, and monitors whether management responds to identified deficiencies; internal audit reports functionally to the governing body to preserve independence.

Risk-based audit planning: rank auditable entities by inherent risk (impact, likelihood, velocity, complexity, regulatory exposure) less control strength; allocate assurance coverage to the highest residual-risk areas and document the rationale.

Residual risk = inherent risk adjusted for the design and operating effectiveness of controls. Assurance conclusions should be based on tested residual risk, not on management's self-reported rating alone.

Engagement objectives must state the risk management question being answered and the scope boundaries (processes, entities, systems, period); unclear objectives are the most common cause of scope creep in CRMA engagements.

Criteria are the standards against which risk management is evaluated: framework requirements (COSO, ISO 31000), regulatory rules, internal policy, or industry practice. Every finding must cite the criterion it violates.

Risk assessment at the engagement level: interview process owners, review risk registers and prior assurance results, map key risks to controls, and identify where control gaps or design weaknesses concentrate testing effort.

Risk register quality tests: risks are stated as causes and consequences tied to objectives, owners are named, ratings use defined scales, controls and residual ratings are documented, and entries are updated after incidents or changes.

Control identification distinguishes preventive from detective and manual from automated controls; key controls are those that most reduce a significant risk, and only key controls warrant extensive testing.

Coordination with other assurance providers (second line, external audit, regulators) reduces duplication and coverage gaps; document reliance decisions and the basis for using others' work.

Evidence must be sufficient (enough quantity), appropriate (relevant and reliable), and documented. Third-party or externally validated evidence is generally more reliable than management assertions or self-assessments.

Walkthroughs confirm understanding of process flow and control design but do not by themselves establish operating effectiveness; operating effectiveness requires testing over a period.

Sampling decision rules: define the population, select a method (random, systematic, haphazard, stratified), and justify sample size by tolerable deviation rate, expected deviation, and confidence level; document the sampling basis.

Test of one or few instances supports design conclusions only; attribute sampling supports frequency-based operating effectiveness conclusions when the population is complete and homogeneous.

Risk and control matrix (RACM) links each significant risk to controls, assertions, test procedures, and evidence references; it is the primary working-paper structure for a CRMA engagement.

Root cause analysis separates symptoms (a missed reconciliation) from causes (no owner, unclear procedure, insufficient staffing, incentive conflict); findings should address causes so recommendations are durable.

Condition-criteria-cause-effect-recommendation structure: state what was found, the standard breached, why it happened, the risk exposure, and management's agreed action with an owner and due date.

Rating scales (e.g., critical/high/medium/low) must be defined in advance by impact and likelihood or by framework significance; ratings should be applied consistently and calibrated across engagements.

An overall assurance opinion is supported only when scope and criteria are explicit and evidence is sufficient; state any scope limitations that prevent a conclusion rather than issuing an unqualified opinion.

Findings are reported to process management for action and escalated to the governing body when risk exceeds appetite, when management accepts significant risk, or when remediation stalls.

Management's risk acceptance of a reported issue requires documented authority at the level defined by policy; internal audit still reports the residual exposure to the governing body.

Follow-up: verify remediation through evidence of implementation and a retest of the control, not merely management's statement of completion; track aging of open issues against agreed due dates.

Issue validation closes the loop: confirm the fix addresses root cause, has an owner, has been operating for a sufficient period, and has not introduced new risk.

Key risk indicators (KRIs) and key performance indicators support continuous monitoring; assurance evaluates whether thresholds are defined, monitored, and escalated when breached.

Quality assurance and improvement program: internal assessments plus periodic external assessment support the credibility of the assurance function and its conclusions.