The contribution of internal audit to enterprise-wide risk management: a literature review

Abstract

This article aims to analyze the forms of involvement of internal audit in enterprise risk management (ERM) systems, by identifying the organizational and institutional factors that influence its positioning. It proposes a conceptual framework to understand how internal audit can support risk governance while maintaining its independence.

The relevance of this study lies in the evolving expectations regarding governance, resilience, and transparency. Traditionally limited to control and compliance roles, internal audit is now increasingly engaged in the proactive identification and management of risks.

The article is based on an integrative literature review, combining theoretical, normative, and empirical sources published between 2000 and 2024, in both French and English. The literature was selected using keyword-based queries across recognized databases such as Scopus, Web of Science, Cairn, and Google Scholar. The analytical framework draws on key organizational theories, including agency theory, stakeholder theory, systems theory, psychosocial approaches, and risk theory.

The findings highlight tensions between assurance and consulting roles, as well as significant differences in audit involvement depending on governance maturity. A conceptual model is proposed to categorize the forms of internal audit involvement in ERM and assess their impact on performance, governance structures, and organizational legitimacy.

JEL Classification : M42, G32, D73, L29.

Type of paper: Theoretical Research