CIA Part 3 — Business Knowledge for Internal Auditing

Transfer ownership of the risk register to internal audit.

Give risk management approval authority over audit findings.

Define roles, information-sharing rules, and an assurance map for key risks.

Stop all communication between the two functions to protect independence.