When an organization has a high level of risk maturity, the internal audit activity is less likely to provide consulting services related to risk management. In highly mature risk environments, organizations typically have well-established risk management processes and capabilities, thereby reducing the need for consulting services from internal audit in this area. Instead, internal audit may focus more on assurance services over the existing risk management processes to ensure they are functioning as intended.
Risk management and internal audit literature discussing the relationship between organizational risk maturity and the role of internal audit.