The IIA has a paper on this subject that is important for all of us. While they have considered updating it from time to time, I think it’s still pretty good. I especially like the guidance on what is acceptable and what is not. For example, it stresses that IA can facilitate a risk assessment, but it is management’s responsibility to identify, assess, evaluate, and respond to risk.
There’s another paper that merits our attention.
Written by thought leaders in risk management (friends of mine), The Future Role of Internal Audit in (Enterprise) Risk Management is a few years old…
