IIA CRMA key terms

Independent, objective evaluation of how well an organization identifies, assesses, and controls risk, giving the board and management confidence that risk processes work as intended.

Governance framework in which operational management owns risk, a risk and compliance function provides oversight, and internal audit gives independent assurance to the governing body.

The internal audit role that reports independently to the board on the adequacy and effectiveness of governance, risk management, and control across the first and second lines.

Coordinated use of assurance work from internal audit, risk functions, external auditors, and other providers to avoid duplication and give the board a complete picture of risk coverage.

Technique that matches each significant risk to the assurance activities covering it, revealing gaps, overlaps, and unassured risks for audit planning and board reporting.

Annual or rolling plan that prioritizes audit engagements according to the significance of risks, control maturity, and assurance gaps rather than by organizational unit alone.

The amount and type of risk an organization is willing to accept in pursuit of its objectives, expressed in statements or limits that guide decisions and audit judgments.

The acceptable variation around a risk appetite, giving practical thresholds or limits within which business units may operate before escalation is required.

Shared values, behaviors, and norms that determine how people identify, discuss, and act on risk, including willingness to escalate bad news.

Signals from senior leadership and the board about expected ethical behavior and risk awareness, which shape conduct throughout the organization.

Structures and processes through which the board directs, oversees, and holds management accountable for strategy, risk, and control.

Board committee, typically independent, that oversees financial reporting, internal audit, external audit, and the organization's risk management and control environment.

Freedom from conditions that threaten objectivity, including reporting lines, budget control, and access to the board that keep assurance judgments unswayed.

A mental attitude of impartiality that lets an assurance provider reach conclusions without bias, conflict of interest, or undue influence from others.

Situation where a person's private interests or prior responsibilities could improperly influence assurance judgments, requiring disclosure, recusal, or reassignment.

A circumstance, such as a recent operational role or personal relationship, that weakens objectivity and must be disclosed and managed before work proceeds.

The sophistication of an organization's risk practices, ranging from ad hoc and reactive to repeatable, managed, and optimized, which shapes assurance scope and depth.

The documented set of principles, processes, roles, and tools an organization uses to identify, assess, treat, monitor, and report on risk.

Organization-wide approach that links risk identification and treatment to strategy and objectives across all units, rather than managing risks in silos.

Structured record of identified risks with owners, ratings, controls, and treatment actions, used to track and report risk status over time.

Process of identifying risks and evaluating their likelihood and impact against objectives, often before and after considering controls.

The level of risk before any controls or mitigation are applied, used as a baseline to judge whether controls are warranted.

The risk remaining after existing controls are considered, which is compared with risk appetite to decide whether further treatment is needed.

The degree to which a control, as designed and operating, reduces risk to an acceptable level, assessed through testing rather than assertion alone.

Procedures such as inquiry, observation, inspection, and re-performance used to determine whether controls operate as intended throughout the period.

Tracing one or a few transactions through the process end to end to confirm understanding of the flow and whether controls are actually in place.

A measurable metric that signals rising or falling exposure to a significant risk, enabling early warning and monitoring against appetite limits.

The accountable individual who manages a specific risk, including implementing treatment and monitoring changes in exposure.

Action chosen to address a risk, such as avoiding, reducing, sharing, or accepting it, with acceptance requiring authority at the right level.

Structured evaluation of how and where fraud could occur, which schemes are plausible, and whether anti-fraud controls address those exposures.

A risk that is new, changing, or not yet well understood, which may fall outside routine monitoring and warrants specific assurance attention.

Judgment that work performed by others, such as external audit or a quality function, is sufficiently reliable to reduce or reshape the assurance needed.

A defined piece of work that evaluates a subject matter against criteria and concludes on whether it meets them, documented in a report.

The boundaries of an assurance engagement, including processes, locations, period, and risks covered, agreed with stakeholders before fieldwork begins.

Written communication of engagement objectives, scope, findings, and an overall conclusion, distributed to management and the governing body as appropriate.

Documented commitments by management to address findings, including responsible owners and target dates, which assurance follows up on.

Verification that agreed actions have been implemented and are effective, with unresolved issues escalated to the board.

Structured program of internal and external assessments that confirms the assurance function operates competently and conforms to professional standards.

Advisory work that adds value without providing independent assurance, requiring safeguards so objectivity is not compromised for later assurance work.