Exam CISA topic 1 question 415 discussion

While operating the risk management framework (Option C) is an important responsibility, it is typically the responsibility of management and the risk management function within the organization. Internal audit's role is to provide independent assurance and validation of the effectiveness of these processes, rather than directly operating them.

The PRIMARY role of an internal audit function in the management of identified business risks is to validate enterprise risk management (ERM). Internal audit validates the effectiveness of the organization's risk management processes, including the identification, assessment, and mitigation of risks.

C. Operating the risk management framework