Internal auditors must remain independent and should not take on management responsibilities. Prioritizing risks for management crosses this line and constitutes assuming a management role, which compromises the auditor's independence and objectivity. References:
* IIA Standard 1112 - Chief Audit Executive Roles Beyond Internal Auditing.
* IIA Standard 1100 - Independence and Objectivity.

In consulting engagements, according to the IIA ' s Standards, a work program is not required but may be developed. This allows internal auditors flexibility to design an approach that best fits the nature of the consulting engagement.
The IIA ' s International Standards for the Professional Practice of Internal Auditing (Standards), particularly the standards related to consulting activities.

The internal audit charter is a formal document that outlines the purpose, authority, and responsibility of the internal audit activity. It includes the functional and administrative reporting lines for the chief audit executive, which helps define the independence and objectivity of the internal audit function. This charter is crucial as it also establishes the framework within which the internal audit team operates, ensuring alignment with organizational goals and governance frameworks.
The Institute of Internal Auditors (IIA) - International Professional Practices Framework (IPPF)

According to IIA guidance, the chief audit executive (CAE) may consider performing a self-assessment with independent external validation in lieu of performing a full external assessment. This is known as a self- assessment with independent validation (SAIV) and is acceptable as a part of the internal audit activity's quality assurance and improvement program. Choosing an independent reviewer or review team to perform sufficient tests of the self-assessment to validate the results is also aligned with IIA standards for maintaining quality within the internal audit function.References: IIA Standard 1300: Quality Assurance and Improvement Program, which outlines requirements for ongoing and periodic reviews of the internal audit activity.

According to IIA standards, assurance services are expected to be included in the risk-based audit plan as they are integral to the systematic evaluation and improvement of risk management, control, and governance processes. Consulting services, however, are typically requested by management and do not necessarily follow the structured inclusion in the risk-based plan, reflecting their more flexible and situational nature.
The IIA's International Standards for the Professional Practice of Internal Auditing, particularly distinctions between assurance and consulting activities.