According to IIA guidance, the standard risk treatments outlined in the process element approach of the framework for risk management include the following steps:
* Risk Identification: Identifying potential risks that could affect the achievement of objectives.
* Risk Assessment: Evaluating the identified risks in terms of their likelihood and impact.
* Application of Controls: Implementing measures to mitigate or manage the identified risks.
* Risk Acceptance: Deciding to accept the risk when it falls within the organization's risk appetite or tolerance levels.
These steps are part of a structured approach to managing risks, ensuring that risks are systematically identified, assessed, and managed through appropriate controls and that acceptance of residual risks is aligned with the organization's strategic objectives and risk appetite.
IIA Practice Guide: Assessing the Adequacy of Risk Management Using ISO 31000 COSO Enterprise Risk Management Framework

The internal audit charter is a formal document that outlines the purpose, authority, and responsibility of the internal audit activity. It includes the functional and administrative reporting lines for the chief audit executive, which helps define the independence and objectivity of the internal audit function. This charter is crucial as it also establishes the framework within which the internal audit team operates, ensuring alignment with organizational goals and governance frameworks.
The Institute of Internal Auditors (IIA) - International Professional Practices Framework (IPPF)

Ongoing monitoring activities are part of the internal assessments within a quality assurance and improvement program (QAIP). Planning and supervising engagements are integral components of ongoing monitoring.
These activities ensure that internal audit engagements are properly planned, executed, and supervised, adhering to established standards and procedures. They help in continuously assessing the performance and effectiveness of the internal audit function and ensuring compliance with professional standards.
IIA Standard 1300: Quality Assurance and Improvement Program
IIA Practice Guide: Quality Assurance and Improvement Program

Developing training and system rollout plans in response to the results of the change readiness assessment of a new sales distribution model qualifies as an acceptable consulting service provided by the internal audit activity. This service is advisory in nature and is designed to add value and improve an organization's operations-aligned with the definition of consulting services under IIA standards. References: IIA definition of consulting services, which includes activities that provide advice and assistance designed to add value and improve an organization's governance, risk management, and control processes without the internal auditor assuming management responsibility.
Top of Form

The most helpful metric to measure the success of an internal audit activity in providing risk-based assurance is the percentage of highly significant risks covered by the internal audit plan. This demonstrates that the internal audit function is focusing its resources on the most critical areas that could impact the organization's objectives, ensuring that significant risks are being addressed and managed appropriately. This alignment with the organization's risk profile is a key indicator of effective risk-based auditing. References: The IIA's International Standards for the Professional Practice of Internal Auditing (Standards), specifically Standard
2010 - Planning, and Standard 2120 - Risk Management.