According to IIA guidance, which of the following roles for the internal audit function regarding...

Maintaining and developing the risk management framework is a role internal audit may undertake when appropriate safeguards are established to protect independence and objectivity. Internal audit can provide advisory support that helps an organization improve risk management, particularly when risk management maturity is still developing. However, management must retain ownership of risk. Setting risk appetite is a governing body and senior management responsibility. Selecting appropriate risk responses and implementing those responses are also management responsibilities because management owns and manages organizational risks. If internal audit assumes those responsibilities, it later may be required to provide assurance over decisions it made itself, creating an unacceptable self-review threat. Therefore, maintaining or developing the framework may be acceptable with safeguards, while options A, B, and C cross into risk ownership and management decision-making.