Internal audit is proposed as unrelated to risk management. Which statement corrects that view?
Select an answer to reveal the explanation.
Short Explanation
Audit is like a scheduled pit stop that checks whether the safety systems still work as advertised. Risk managers often help set up those checks so compliance and controls do not quietly drift. Calling the two unrelated leaves the garage door open.
Full Explanation
Internal audit and risk management are complementary. Risk managers may help establish internal-audit processes that verify continued compliance, test whether safety and control systems still operate as designed, and feed findings back into the register. Declaring the functions unrelated leaves assurance gaps. Saying internal audit replaces risk management so the two must never coordinate confuses assurance with risk ownership and blocks useful handoffs. Requiring risk managers to avoid auditors forever "for independence" overstates separation and can prevent closing control gaps. Claiming internal audit applies only to publicly traded firms excludes civic agencies that still need control testing and compliance verification. Exam caveat: coordination between risk and audit is expected; mutual exclusion is the trap. Operational check: schedule a joint walkthrough of one safety or continuity control with internal audit (or an equivalent assurance partner), log deficiencies to both the audit tracker and the risk register, and assign owners with due dates. Confirm the next committee packet shows the closed-loop result for that municipal control. In civic practice, keep the same vocabulary in board minutes, toolbox talks, and the live register so department heads do not reintroduce casual synonyms after training. Re-check the concept during the next quarterly risk review against one real municipal example so the distinction stays operational rather than slogan-only.