Combined internal audit and risk management function
An arrangement in which internal audit (the third line) and risk management activities (the second line) fall under one responsible person, usually the head of internal audit. The Global Internal Audit Standards allow this with safeguards; at banks, pension funds and, from 30 January 2027, insurers under Solvency II it is not permitted.
Source: IIA Global Internal Audit Standards 2024 (Standards 2.2 en 7.1); IIA Statement of Position Three Lines Model (2026); Internal Audit Monitor 2021 en 2025
In the Three Lines Model, risk management is a second-line function and internal audit the independent third line. Even so, organisations regularly combine the two under one head. The Internal Audit Monitor 2021 counted five Dutch listed companies with such a combined function in their annual reports for 2020; according to the Internal Audit Monitor 2025 there were four in 2024. In external quality assessments the researchers saw the combination more often, particularly in smaller organisations and organisations with a still immature second line.
The case for a combination is that both functions work for the management board and supervisory board and that their work is closely related. Directors get one coherent picture of internal control, in one language and with one point of contact, and for smaller organisations it brings efficiency. On the other hand there is the independence of the third line: internal audit cannot provide independent assurance on activities for which it is responsible itself.
The Global Internal Audit Standards allow the Chief Audit Executive to fulfil other roles as well, provided the board acknowledges the potential impairment of independence and safeguards are agreed. For the areas under the Chief Audit Executive, assurance must be arranged in another way, for example through an objective, competent external provider that reports independently to the board. Where assurance concerns an activity for which an auditor was responsible in the preceding twelve months, the Standards presume that objectivity is impaired. The IIA's Statement of Position on the Three Lines Model (July 2026) also asks for a documented division of tasks, approval of the broader remit by the board and transparency about it. In the Dutch two-tier model, the board means the management board and the supervisory board with its audit committee.
Stricter rules apply in the financial sector. At banks the audit function is combined with no other function, at pension funds not with another key function, and insurers under Solvency II may combine it only under strict conditions until 29 January 2027 and no longer from 30 January 2027.
ONE Risk Advisory helps organisations design such a combination responsibly, with a clear division of tasks, appropriate safeguards and independent assurance on risk management.
Last updated:
Related service Internal Audit
Frequently asked questions
May the head of internal audit also lead risk management?
Under the Global Internal Audit Standards, yes, with safeguards: the board acknowledges the potential impairment of independence, the division of tasks is documented and assurance on risk management is arranged through another independent party. At banks, pension funds and, from 30 January 2027, insurers under Solvency II, the combination is not permitted.
How common is a combined function at listed companies?
In annual reports, not very: according to the Internal Audit Monitor 2025, four Dutch listed companies had a function combining internal audit and risk management in 2024. In external quality assessments the researchers saw the combination more often than the annual reports show.