Risk managers should work with audit

Collaboration between the disciplines of internal audit and risk management can lead to stronger, more efficient decision making and enhance an organisation’s overall risk  management capability, according to a new report.

The publication, jointly released by RIMS (Risk and Insurance Management Society, Inc.) and The Institute of Internal Auditors(The IIA), defined the roles and responsibilities of both the risk management and internal audit functions.

It highlighted four common practices, as well as the value that each of these practices generates for organisations. 

The report also featured four cases that highlight different approaches by certain “highly regarded” organisations have taken to realise the benefits of forming such alliances: Cisco Systems, Hospital Corporation of America, TD Ameritrade, and Whirlpool Corporation.

“The risk management and internal audit roles are complementary. An overarching common goal is to position organizations for successful achievement of their respective missions and business objectives,” said Carol Fox, RIMS Director of Strategic and Enterprise Risk Practice.  

“As noted in the report, the two disciplines are more effective working together than separately, especially when there is a common understanding of each other’s roles. For example, as internal audit offers assurance as to management’s effectiveness regarding strategic risks, the risk management function provides the techniques and methods for management to be most effective.”

“In the end, risk managers and internal auditors have many of the same stakeholders – boards and executive management, and these stakeholders want to maximize resources while effectively managing risk,” indicated IIA Vice President of North American Services Hal Garyn, CIA. 

“Having these vital risk management and assessment functions collaborate, speak the same language, and leverage one another’s perspectives on the business is crucial.  The sum is truly greater than their parts.”