The board is responsible for setting the organizational attitude through tone at the top,

The internal audit activity will provide assurance over operating effectiveness but not over the design of risk management activities,

The internal audit activity can give objective assurance on any part of the risk management framework for which it is responsible.

The framework is designed to be effective for organizations no matter how small.