When developing performance standards to measure an organization's risk management process, internal audit may use the key principles approach. This approach involves identifying and applying fundamental principles that underpin effective risk management practices. These principles provide a benchmark against which the organization's risk management process can be assessed, ensuring that the process aligns with best practices and contributes to achieving organizational objectives.
References:
* IIA Practice Guide: Assessing the Adequacy of Risk Management Using ISO 31000
* COSO Enterprise Risk Management Framework