Governance, Risk, and Internal Control
This domain tests how internal audit fits into governance, how risk is owned and managed, and how control frameworks are used to evaluate design and operation.
Core rules and concepts
- The board provides oversight and sets risk appetite; senior management executes strategy and manages risk within that appetite. Risk appetite is the amount of risk the organization is willing to accept; risk tolerance is the acceptable variation around it.
- The Three Lines Model places operational management as the first line owning and managing risk, risk and compliance functions as the second line providing expertise and challenge, and internal audit as the independent third line providing assurance.
- Internal audit must not design or operate the controls it later audits without safeguards; doing so impairs objectivity and independence.
- COSO's internal control framework has five components: control environment, risk assessment, control activities, information and communication, and monitoring. Control activities may be preventive or detective, manual or automated.
- Internal audit uses the organization's risk assessment to plan, but it does not own enterprise risk management.
Worked example
A procurement director asks internal audit to approve the vendor scoring matrix before rollout. Approving management's design is a management decision and would compromise later assurance. Internal audit may provide advice on control design as consulting, disclose the impairment, and avoid auditing that same process until independence is restored. The director, not internal audit, owns the matrix.
Traps that cost marks
Saying the audit committee manages risk; treating monitoring as solely an internal audit duty; confusing risk appetite with tolerance; and treating COSO ERM as identical to the internal control framework.