Skills and body of knowledge
Internal auditors and risk managers share some knowledge, skills and values. Both, for example, understand corporate governance requirements; have project management, analytical and facilitation skills and value having a healthy balance of risk rather than extreme risk-taking or avoidance behaviors. However, risk managers as such serve only the management of the organization and do not have to provide independent and objective assurance to the audit committee. Nor should internal auditors who seek to extend their role in ERM underestimate the risk managers’ specialist areas of knowledge (such as risk transfer and risk quantification and modeling techniques) which are outside the body of knowledge for most internal auditors. Any internal auditor who cannot demonstrate the appropriate skills and knowledge should not undertake work in the area of risk management. Furthermore, the head of internal audit should not provide consulting services in this area if adequate skills and knowledge are not available within the internal audit activity and cannot be obtained from elsewhere.