The Institute of Internal Auditors in Australia has issued the following publications, which should interest boards and management:

In its '20 critical questions' series, the institute has examined what directors should ask of risk management.

Questions are posed under headings such as risk-management foundations, risk assessment, risk registers and review.

The first is 'Does the organisation have (a) risk management framework aligned to an appropriate standard such as ISO 31000:2018 'Risk management – Guidelines' (b) defined risk appetite ideally encapsulated in a risk appetite statement?'

And a 'killer question' is posed. 'How does management, audit or risk committee and board of directors clearly know the organisation has identified and is effectively managing its risks in a timely way?'