The board asked the chief audit executive (CAE) to assume responsibility for a newly formed...

Because the CAE has management responsibility for the risk management function, internal audit cannot independently provide assurance over that function without appropriate safeguards. The strongest safeguard is to obtain assurance from a competent provider outside the internal audit function. Otherwise, internal audit would effectively be evaluating an activity for which its own leader is responsible, creating a significant self-review threat to independence and objectivity. Assigning other internal auditors does not fully eliminate the organizational impairment because they remain within the function directed by the CAE. Supervision by risk and compliance management would further compromise independence. The existing Internal Audit Fundamentals material presents the same principle: when a CAE has responsibility for risk management and compliance, assurance over those activities should be provided or overseen independently.