The board asked the chief audit executive (CAE) to assume responsibility for a newly formed risk management function while retaining responsibility for the internal audit activity. The new function is comprised of both risk and compliance activities. How should next year's internal audit of the risk management function be performed?
The chief audit executive (CAE) assuming responsibility for both the internal audit activity and the newly formed risk management function creates a conflict of interest. To ensure independence and objectivity, next year's internal audit of the risk management function should be performed by a competent assurance provider external to the internal audit activity. This will help maintain the integrity of the audit process.
Why not A?