Figure 1 presents a range of ERM activities and indicates which roles an effective professional internal audit activity should and, equally importantly, should not undertake. The key factors to take into account when determining internal auditing’s role are whether the activity raises any threats to the internal audit activity’s independence and objectivity and whether it is likely to improve the organization’s risk management, control and governance processes