Integrate enterprise risk management and internal controls
Use the business objective to connect enterprise risk management with internal controls. Identify the risk response, translate it into specific control activities, and evaluate the remaining exposure. A framework label is an organizing aid; the real test is whether the response addresses the risk in this process.
A connected risk-to-control map
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Enterprise objective | Reliable delivery promises support customer retention. | Beginning with a generic framework checklist and never identifying the business outcome. |
| Risk response | Reduce supply interruption through qualified alternative suppliers. | Assuming a risk register entry means the response was implemented. |
| Control evidence | Inspect qualification reviews, sourcing limits, and actual alternate-supplier readiness. | Counting two supplier names without checking common ownership or location. |
Enterprise objective
Reliable delivery promises support customer retention.
Avoid: Beginning with a generic framework checklist and never identifying the business outcome.
Risk response
Reduce supply interruption through qualified alternative suppliers.
Avoid: Assuming a risk register entry means the response was implemented.
Control evidence
Inspect qualification reviews, sourcing limits, and actual alternate-supplier readiness.
Avoid: Counting two supplier names without checking common ownership or location.
A decision path you can use
- 1Objective and exposure
- 2Response and control owner
- 3Evidence and residual risk
Understand the method
Work through the reasoning
Give enterprise risk management and internal control distinct jobs
Enterprise risk management connects uncertainty with strategy, objectives, and the organization’s choices about exposure. Internal control concerns arrangements that support the achievement of objectives and the execution of selected responses. A risk register and a controls inventory are therefore related but different tools. One identifies and assesses uncertainty; the other should explain what actions address it.
Integration starts with the business objective. If a retailer wants reliable online delivery, relevant risks may include stock inaccuracies, supplier failures, and system outages. Each risk needs a response, and some responses require controls. Listing a familiar framework component without explaining that connection adds terminology without showing whether the organization can achieve its delivery objective.
Trace a risk response into specific control activities
A response may involve accepting, avoiding, reducing, or sharing exposure, depending on the circumstances. A decision to reduce stock-record errors could lead to access restrictions, reconciliations, and exception investigations. Describe the action, owner, frequency, evidence, and escalation path. “Use controls” is not an implementable response, and “has a policy” is not evidence of an effective activity.
Work in both directions. Starting from a significant risk helps identify missing controls. Starting from an existing control helps identify activity that has no clear purpose or is no longer proportionate. This two-way mapping is especially useful after a strategy or system change, when a legacy control inventory may no longer match the risks that now matter.
Evaluate remaining exposure rather than counting controls
The number of controls does not determine the level of residual risk. Several controls may rely on the same weak data or the same person, creating common failure points. A highly reliable control may still leave exposure outside its scope. Assess design, operation, and interdependence before deciding what risk remains after the response.
Management compares that remaining exposure with the organization’s risk boundaries and makes the relevant decisions. Audit evaluates the reasoning and supporting evidence. An auditor should not quietly substitute a personal appetite for management’s authorized decision, but should communicate when the evidence indicates exposure beyond the organization’s accepted boundaries or when the decision process is not working.
Use frameworks to find gaps, not to manufacture compliance
Frameworks provide organized ways to consider governance, culture, assessment, control activities, information, and monitoring. Their value lies in the questions they help answer. A completed mapping spreadsheet can still conceal a missing owner, unreliable information, or a control that never operates. Match the framework’s concepts to the organization’s actual processes and objectives.
Avoid treating different frameworks as identical lists with interchangeable labels. Clarify which framework is being used, its purpose, and the criteria relevant to the engagement. When an organization uses more than one, explain how the responsibilities and evidence connect. The audit conclusion should concern the evaluated arrangements, not the mere presence of framework names in a policy.
Original teaching example
Apply the method to a decision
The scenario
A manufacturer lists two suppliers as its response to delivery disruption. Both suppliers rely on the same port and the alternate has never produced the required specification.
The decision
Challenge whether the response actually reduces the identified concentration and continuity risks.
The risk register looks complete, but the operational evidence undermines its conclusion. Assess the common dependency and qualification gap before accepting the residual-risk rating. More entries in a spreadsheet do not necessarily mean more resilience.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
A new sales channel changes the control map
The situation
A wholesaler introduces direct online sales. Its old risk register focuses on credit approval for business customers, while the controls inventory still lists monthly checks designed for large invoices.
Reason through it
The new objective and transaction pattern introduce different exposures, including automated fulfillment and high-volume refunds. Existing controls may still matter but no longer cover the whole process. Map the new risks to responses, owners, and operating evidence, then assess the remaining gaps.
Take the decision
Update the risk-to-control connection for the changed business model. Reusing the old framework checklist without reexamining objectives would overstate coverage.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Does adopting a framework prove that controls are effective?
No. It can make responsibilities and evaluation more consistent, but implementation and operating evidence still matter. A control can be documented yet poorly designed, bypassed, or applied inconsistently.
Is a risk register the same as a control framework?
No. A register records identified risks and related assessments or responses. A framework organizes principles or components used to evaluate arrangements. Both need a clear connection to actual objectives, controls, and evidence.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Governance, Risk Management, and Control (30% of Part 1). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standard 9.1. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
- IIA role of internal audit in ERM: 2026 Statement of Position
- Executive summary, page 3; ERM definition and activities, pages 6-11. Supports connecting enterprise objectives, risk activity, and audit assurance or advice. The supplier scenario is our own illustration; the statement does not prescribe that specific control design.
Part 1: Internal Audit Fundamentals. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.