Role of internal audit in risk management. Only a limited number of responding companies have a formal internal control charter. It is also remarkable to notice that in a lot of companies, not everyone knows the policies and procedures he or she has to follow. Gaps are observed by sector in terms of risk management practices. On average, 9 per cent of the working time of internal audit departments is spent on separate risk management activities.