The key principles approach to risk management involves evaluating whether the organization ' s risk management practices align with fundamental principles, such as being an integral part of decision making, being transparent, responsive to change, and addressing uncertainty. This approach focuses on assessing the adherence to core risk management principles rather than specific processes or maturity levels.

The maturity model approach (A) assesses the level of sophistication and development of risk management practices. The process element approach (B) evaluates specific components of the risk management process. The key performance indicators approach (D) focuses on using specific metrics to gauge the effectiveness of risk management.

The internal auditor’s focus on the integration of risk management into decision making and its responsiveness to change aligns with the key principles approach as outlined in IIA guidance on risk management frameworks.

IIA Practice Guide: Assessing the Adequacy of Risk Management Using ISO 31000

IIA Position Paper: The Role of Internal Auditing in Enterprise-Wide Risk Management