According to IIA guidance, the standard risk treatments outlined in the process element approach of the framework for risk management include the following steps:
* Risk Identification: Identifying potential risks that could affect the achievement of objectives.
* Risk Assessment: Evaluating the identified risks in terms of their likelihood and impact.
* Application of Controls: Implementing measures to mitigate or manage the identified risks.
* Risk Acceptance: Deciding to accept the risk when it falls within the organization's risk appetite or tolerance levels.
These steps are part of a structured approach to managing risks, ensuring that risks are systematically identified, assessed, and managed through appropriate controls and that acceptance of residual risks is aligned with the organization's strategic objectives and risk appetite.
IIA Practice Guide: Assessing the Adequacy of Risk Management Using ISO 31000 COSO Enterprise Risk Management Framework

One of the essential skills for a head of internal audit is the ability to apply the International Professional Practices Framework (IPPF) issued by the Institute of Internal Auditors (IIA). The IPPF consists of mandatory and supplemental guidance that provides the principles, standards, and best practices for internal audit activities. A head of internal audit should be familiar with the IPPF and ensure that the internal audit function conforms to its requirements and expectations. The IPPF also helps the head of internal audit to demonstrate the value and quality of internal audit to the stakeholders.
Additional Information:
Data analysis and mining, technical and IT skills, and risk management and planning are also important, but they are not specific to the role. The mandatory guidance of the IPPF includes the Core Principles, the Code of Ethics, the Standards, and the Definition of Internal Auditing. The supplemental guidance includes Implementation Guidance, Supplemental Guidance, and Practice Advisories.

In The IIA's Three Lines Model, internal audit (the third line) should be aligned with first- and second-line functions through effective communication, cooperation, and collaboration (Option D). This alignment ensures that internal audit activities are coordinated with risk management and control functions while maintaining independence. According to the Three Lines Model, internal audit adds value by providing independent assurance on the effectiveness of governance, risk management, and control processes, which requires ongoing interaction with the first and second lines without compromising objectivity.
IIA's Three Lines Model
IIA Standards, Standard 2050: Coordination and Reliance

Strong management oversight of the purchasing and accounts payable functions best mitigates the risk of corruption schemes between employees and vendors. This control ensures that transactions are reviewed and approved at appropriate levels, which helps prevent and detect collusion and corrupt practices.
IIA guidance on preventing and detecting corruption.