A core responsibility of internal audit is to evaluate the effectiveness of the organization’s risk management processes and contribute to their improvement. This assurance role preserves the distinction between management, which owns and manages risk, and internal audit, which independently evaluates how effectively that responsibility is being fulfilled. Consolidating enterprise risk reporting and coordinating risk management activities are normally management or risk-function responsibilities. Internal audit may provide advisory assistance concerning risk responses, but it should not determine responses on management’s behalf or guarantee that risk will remain within appetite because doing so could create management responsibility and impair objectivity. The existing Internal Audit Fundamentals material likewise describes internal audit as evaluating risk-management effectiveness and reporting on management’s assessment of significant risks rather than owning the process.