The appropriate responsibility for the internal audit activity with regard to the organization's risk management program is to ensure that a proper and effective risk management process exists. Internal auditors are tasked with evaluating the effectiveness of risk management processes, not with identifying and managing risks or ensuring controls directly. They are there to review and ensure that the processes themselves are robust and functioning as intended.