A county IRM architect wants internal audit to reuse risk register data for engagement planning without making audit a second risk owner. Which architecture best preserves third-line independence?
Select an answer to reveal the explanation.
Short Explanation
Think of the risk register like a shared weather map: auditors can read the forecast without grabbing the steering wheel. Third-line work should reuse IRM data for planning, but engagements and workpapers stay on their own track so independence does not collapse into day-to-day risk ownership.
Full Explanation
In civic IRM architecture, third-line independence is preserved when Internal Audit may consume shared risk and control evidence for engagement planning while audit engagements and workpapers remain on a separate lifecycle from first- and second-line risk response. County architects should treat the risk register as a readable system of record for scoping and risk-based planning, not as a place where auditors become residual owners or close mitigation tasks that belong to business risk owners. That separation lets auditors reuse IRM entities, risks, and controls without collapsing the three lines of defense into a single operating queue.
Merging audit engagements into the same risk-response workflows that risk owners close fails the independence concept: auditors would participate in owning and completing management’s treatment work rather than providing objective assurance. Letting auditors edit residual scores whenever they open an engagement likewise collapses roles—score ownership stays with risk owners, and ad hoc auditor edits create contested systems of record. Disabling risk visibility and forcing auditors to rebuild findings only from email exports preserves a brittle paper trail at the cost of IRM’s purpose: shared evidence with governed access, not forced ignorance.
Exam caveat: CIS-RC expects reuse of IRM data by Audit without converting Audit into a second risk-owner persona. Consumption and separate engagement lifecycle are compatible; joint ownership of residual scoring and response closure are not.
Operational check: confirm auditors have read (or controlled consume) access to in-scope risks and controls; verify engagement and workpaper tables are distinct from risk-response task closure; sample one planned engagement and show that residual scores were not edited by audit roles during planning; document the independence boundary in the municipal GRC operating model.