On July 8, 2026, the Institute of Internal Auditors (IIA) issued a new Statement of Position titled The Role of the Internal Audit Function in Enterprise Risk Management. The guidance replaces the IIA’s 2009 position paper on internal auditing’s role in enterprise-wide risk management and addresses how internal audit can contribute to enterprise risk management (ERM) while preserving independence and objectivity. The IIA released a companion Statement of Position, Three Lines Model: Assurance and Advice in Support of Effective Governance, the same day, and the two are designed to be read together.

The Statement defines ERM as a coordinated, organization-wide approach to identifying, assessing, managing, monitoring, and reporting threats and opportunities. It also describes ERM as a continuous process integrated across the organization rather than a periodic exercise or static risk register.

Statements of Position are principles-based and are not part of the IIA’s International Professional Practices Framework; they are written primarily for boards, audit committees, and executives. The guidance is consistent with the Global Internal Audit Standards, including the Standard 7.1 requirement that any chief audit executive roles beyond internal auditing, and the related safeguards, be documented in the internal audit charter.

ERM Accountability at a Glance

The Statement assigns distinct responsibilities across the organization. The board, management and second-line functions, and internal audit each play a defined role in overseeing, managing, and providing assurance over risk.

• Board: Establishes expectations and oversees senior management, including setting the organization’s risk appetite and risk tolerance.
• Management and second-line functions: Management owns risk and is responsible for implementing ERM processes, while second-line functions such as risk management provide specialist support, monitoring, and challenge to first-line decisions.
• Internal audit: As the third line, it provides independent, risk-based, and objective assurance and advisory services without assuming responsibility for management’s risk decisions.

Internal Audit’s Role Across ERM

The Statement identifies assurance and advisory services as complementary contributions of internal audit. Assurance evaluates the design and effectiveness of ERM processes, including their alignment with risk appetite, risk tolerance, strategy, and governance expectations, and whether significant risks are consistently identified, assessed, and escalated. Advisory activities may include facilitating risk discussions, challenging assumptions, providing input on risk methodologies, and offering perspective based on observations across the organization. The right balance between the two depends on ERM maturity, the organization’s risk environment, the strength of other assurance providers, and direction from the board.

The IIA organizes ERM activities around five elements: identify, assess, manage, monitor, and report. For each element, internal audit may provide assurance or advice and use risk information to plan audits. The Statement is equally explicit about what internal audit must not do: determine or prioritize risk responses, select or implement them, own management’s follow-up, or own reporting to external parties. Those remain management responsibilities.

Independence, Objectivity, and Overlapping Responsibilities

The updated guidance places particular emphasis on maintaining internal audit’s independence and objectivity when responsibilities overlap. It addresses two common scenarios. In the first, the internal audit function performs activities typically associated with a second-line risk management function; the Statement notes this occurs particularly in smaller or evolving organizations and treats it as transitional or exceptional rather than permanent. In the second, the chief audit executive supervises a separate risk management function; even with operational separation, the shared reporting line can raise perceived objectivity concerns. The Statement also acknowledges that legal and regulatory requirements may preclude certain structures, a point of particular relevance for banks and other regulated institutions.

When internal audit or the chief audit executive takes on an expanded ERM role, the Statement expects safeguards that are deliberate, proportionate, and visible to the board through the internal audit charter. These typically include:

• Documented responsibilities: Roles across management, the second line, and internal audit are defined at the activity level.
• Board approval: The board formally approves expanded responsibilities and acknowledges the associated risks and mitigation measures.
• Separation of advisory and assurance work: Individuals who designed or operated a process within the last 12 months do not provide assurance over it.
• Transparency: Actual or perceived impairments to objectivity are disclosed to the board.
• Ability to challenge: The chief audit executive can push back on assignments that would significantly impair independence; making an assignment temporary, with a transition plan, can mitigate the impact.
• Independent assurance: Where internal auditors perform or supervise ERM activities, assurance over those areas must come from another qualified, independent party, internal or external.
• Periodic external review: External quality assessments or targeted independent reviews confirm that independence and objectivity remain intact.

Coordination and Integrated Assurance

The guidance also addresses coordination and reliance among assurance and advisory providers. An assurance map may be used to identify gaps and duplication, while integrated assurance can help align risk information and assurance activities across the organization. The Statement says the chief audit executive should facilitate an integrated approach and that internal audit is best placed to do so because of its organization-wide perspective and direct reporting line to the board. Reliance on other providers should improve efficiency without transferring accountability, and the board should maintain visibility over reliance decisions.

Questions for Audit Committees and Chief Audit Executives

Boards, audit committees, and chief audit executives can use the Statement to test their current structure:

1. Does internal audit maintain the enterprise risk register, own risk scoring methodology, monitor key risk indicators, or consolidate ERM reporting for management?
2. If so, are those responsibilities documented in the internal audit charter and formally approved by the board?
3. Who provides independent assurance over ERM activities that internal audit performs or supervises?
4. Are internal auditors who designed or operated ERM activities within the last 12 months excluded from related assurance work?
5. Is there a current assurance map, and does the board have visibility into reliance decisions?

How CRI Can Help

The full guidance is available in the IIA’s The Role of the Internal Audit Function in Enterprise Risk Management Statement of Position.

For questions about the updated guidance or how it applies to your organization’s internal audit and ERM structure, contact us at InternalAudit@CRI adv.com. CRI’s Internal Audit professionals help boards and chief audit executives apply the new guidance, including mapping ERM responsibilities and updating internal audit charters, providing independent assurance over ERM activities that internal audit performs or supervises, building assurance maps and integrated assurance programs, and conducting external quality assessments and independence reviews.