Implementing enterprise risk management (ERM) helps organizations identify, assess, and manage emerging risks. As global ecosystems face intensifying environmental, social and governance (ESG) pressures—including climate risks, regulatory demands for sustainability reporting and stakeholder expectations for ecosystem protection —the internal audit function (IAF) plays an increasingly critical role in helping organizations monitor and respond to these risks. Internal auditors’ expertise supports risk identification and assessment, though management maintains responsibility for risk management and control. Using the Committee of Sponsoring Organizations’ (COSO) ERM framework, we review 77 studies across 23 journals published between 2004 and 2024. Prior research primarily examines internal audit’s assurance and consulting roles, with considerably less attention given to activities that compromise independence. While evidence suggests that internal audit quality enhances risk management effectiveness, uncertainty remains about boundaries for consulting activities and technology-enabled assurance. Our synthesis highlights limited empirical insight into internal audit’s strategic partnership role in ERM and identifies future research opportunities for scholars, practitioners and standard setters.
Nkansa et al. (2025) studied this question.