Risk Management, Internal Control and Internal Audit
This domain tests three related but distinct systems - enterprise risk management, internal control and internal audit - and whether you can place each in the right accountability structure.
Risk management
ISO 31000:2018 sets out principles, a framework and a process: scope and context, identification, analysis, evaluation, treatment, monitoring and communication. COSO ERM 2017 organises the same territory around governance and culture, strategy and objective-setting, performance, review and revision, and information and reporting. Distinguish risk appetite (how much risk the board will accept) from risk tolerance and risk capacity, and inherent from residual risk. Risk registers need owners, ratings and treatment plans to be useful.
Internal control
COSO's 2013 framework has five components - control environment, risk assessment, control activities, information and communication, monitoring - supported by seventeen principles. Controls are preventive or detective; typical examples are segregation of duties, authorisation limits, reconciliations, physical safeguards and IT general controls. Controls have inherent limits: collusion, management override and cost-benefit trade-offs.
Three lines and internal audit
Under the IIA's Three Lines Model, management owns risk (first line), risk and compliance functions support and challenge (second line), and internal audit provides independent assurance (third line) to the governing body. Internal audit should have a charter, functional reporting to the audit committee, and a risk-based plan.
Worked example
One finance officer can create a supplier in the master file, approve the invoice and release payment. That is a segregation-of-duties failure in control activities, not an internal audit problem. A detective compensating control - monthly review of vendor master changes by an independent manager - reduces the exposure until duties are separated.
Traps that cost marks
Treating internal audit as external audit. Describing internal control as purely accounting. Concluding a control is effective because a small sample showed no exceptions. Placing internal audit in the second line. Treating the risk register as a compliance artefact rather than a live management tool.