4.1 Governance, Risk Management, and Control Overview
Key Takeaways
- Section C (Governance, Risk Management, and Control) is worth 30% of CIA Part 1 — one of the two heaviest sections, second only to Section A, Foundations of Internal Auditing (35%).
- Governance, risk management, and control are three interdependent processes: governance sets direction and oversight, risk management identifies what could derail objectives, and control provides assurance objectives are met.
- The IIA's Three Lines Model (2020) replaced the older 'Three Lines of Defense' and assigns roles to the governing body, management (first and second line), and internal audit (third line).
- Internal audit's core role across this section is to evaluate and contribute to improving governance, risk management, and control processes — not to own or operate them.
Why This Section Carries So Much Weight
Section C — Governance, Risk Management, and Control is worth 30% of the CIA Part 1 exam, one of the two largest shares of any section in Essentials of Internal Auditing. Only Section A, Foundations of Internal Auditing (35%), carries a heavier weight, so treat Governance, Risk Management, and Control as the second-heaviest block. If Part 1 has roughly 125 scored questions, you should expect around 38 items drawn from this material — enough to swing whether you pass comfortably or finish on the borderline.
The good news: the section is built on a small number of authoritative frameworks — the IIA's Global Internal Audit Standards (effective 9 January 2025), the IIA Three Lines Model (2020), COSO Enterprise Risk Management – Integrating with Strategy and Performance (2017), and the COSO Internal Control – Integrated Framework (2013). Learn those four anchors cold and most questions become recognizable.
The three nouns in the section name are not interchangeable; the exam tests whether you can keep them distinct:
| Concept | Plain-English purpose | Who owns it |
|---|---|---|
| Governance | The combination of processes and structures the board uses to inform, direct, manage, and monitor the organization toward its objectives | The board / governing body |
| Risk management | Identifying, assessing, and responding to the events (risks) that could affect achievement of objectives | Management |
| Control | Any action taken by management, the board, and others to manage risk and increase the likelihood objectives are achieved | Management |
How the Three Processes Interlock
The exam loves questions that test the logical chain linking these concepts. Governance comes first: the board sets objectives, risk appetite, ethical tone, and oversight expectations. Risk management then operates inside that mandate — management identifies what could prevent the organization from meeting the board's objectives and decides how to respond. Control is the response mechanism: controls are the specific actions that bring risk down to a level the board is willing to accept.
A frequent distractor on the exam blurs ownership. Memorize this hard rule: management owns risk and control; the board oversees; internal audit assures. Internal audit evaluates the adequacy and effectiveness of governance, risk management, and control — it does not design, install, or operate the controls it later audits, because doing so would impair objectivity. When a question asks "what is the internal auditor's primary responsibility regarding the organization's risk-management process," the answer is to assess and report on whether that process is effective, not to perform the risk assessment for management.
The frameworks you must recognize on sight
- IIA Global Internal Audit Standards (2025) — five Domains, 15 Principles, 52 Standards; replaced the 2017 International Professional Practices Framework standards.
- IIA Three Lines Model (2020) — principles-based update of the old "Three Lines of Defense."
- COSO ERM (2017) — five components, 20 principles; integrates risk with strategy and performance.
- COSO Internal Control – Integrated Framework (2013) — five components, 17 principles; the default model for evaluating internal control.
Keep these anchors separate. The Standards govern how internal audit itself works; the Three Lines Model places internal audit relative to management and the board; the two COSO frameworks supply the vocabulary the exam uses for risk and control.
What "Essentials" Means for the Question Style
Part 1 questions in this section are predominantly conceptual and definitional, not computational. You will be asked to classify a control as preventive or detective, to name which COSO component a scenario describes, to identify which line of the Three Lines Model a function occupies, or to distinguish inherent risk from residual risk. Because the frameworks share vocabulary, the test writers exploit near-synonyms. Train yourself to pair each term with its exact definition and its owner.
A reliable way to study this section is to keep one running comparison sheet that forces the distinctions the exam rewards:
- Inherent risk vs. residual risk — before controls vs. after controls.
- Risk appetite vs. risk tolerance — the broad amount of risk an organization will accept in pursuit of value vs. the acceptable variation around a specific objective.
- Assurance vs. advisory — internal audit's two service types, both of which can address governance, risk, and control.
- Governance vs. management — direction and oversight vs. execution.
Keep returning to internal audit's vantage point. Across every subtopic in this chapter, the recurring exam answer is that internal audit provides independent, objective assurance and advice on whether governance, risk-management, and control processes are designed adequately and operating effectively — escalating significant deficiencies to senior management and the board.
How to Allocate Your Study Time
Because this section is so heavily weighted, treat it as a backbone of your Part 1 plan rather than just one chapter among several. A practical sequence is to learn the four frameworks first as standalone references, then study how internal audit interacts with each, and finally drill scenario classification until it is automatic. Candidates who fail Part 1 narrowly often lose points here by under-preparing the COSO frameworks or by confusing ownership of risk and control.
Conversely, candidates who over-learn this material often pass comfortably even if weaker areas — such as the foundations content in Section A or the ethics material in Section B — cost them a few questions.
This section also rewards integration, not just memorization. Many questions weave two concepts together, asking not only "what is this?" but "what should the internal auditor do about it?" The correct action is almost always to assess, document, and report — never to take over a management function. Anchor every answer to the assurance role.
Within the relationship among governance, risk management, and control, which statement best describes the role of internal audit?
An exam item states that risk management 'identifies what could prevent the organization from achieving objectives' while another process 'provides assurance those objectives are met.' The second process is: