An organization does not have a formal risk management function. According to the Standards, which of the following are conditions where the internal audit activity (IAA) may provide risk management consulting?
- There is a clear strategy and timeline to migrate risk management responsibility
back to management. - The IAA has the final approval on any risk management decisions. - The IAA does not give objective assurance on any part of the risk management
framework for which it is responsible. - The nature of services provided to the organization is documented in the internal audit charter.