This is a short article illustrating the domain of modern business risk management.
Internal control is management's response to business risk.
The new definition of internal auditing asks internal auditors to shift their perspective to the underlying business risks. Thinking about business risk requires many of the same analytical tools found in every internal auditor's training, plus a few new concepts. A thorough understanding of the business process implies a collaborative approach to understanding risk management. The internal auditor, because the auditor is outside of the process, can never be as knowledgeable about the process as the manager who operates it. In the same manner, those that are immersed in a business process, such as the management team, probably lack the perspective an internal auditor can bring having examined a number of similar processes.