d. Internal Auditing
1) According to The IIA, internal auditors may be directed by the board to evaluate the effectiveness and contribute to the improvement of risk management processes.
2) The internal auditors’ determination of whether risk management processes are effective is a judgment resulting from the assessment that
a) Entity objectives support and align with its mission.
b) Significant risks are identified and assessed.
i) Appropriate risk responses are selected that align risks and the entity’s risk appetite.
ii) Relevant risk information is captured and communicated in a timely manner across the entity, enabling staff, management, and the board to carry out their responsibilities.