People undertake risk management activities to identify, assess, manage, and control all types of events or situations. This can range from a single project or narrowly defined types of risk, for example, market risk, to the threats and opportunities faced by the organization. Organizations are under pressure to identify all business risks they face - social, ethical, and environmental risks as well as financial and operational - and to explain that they are being managed at an acceptable level. Risk management is a basic element of corporate governance. Management is responsible for establishing and operating the risk management framework on behalf of the board. A company's risk management brings many benefits that result from its structured, consistent, and coordinated approach. The key role of internal auditors concerning enterprise risk management should be to assure the effectiveness of risk management to management. When an internal audit extends its activities beyond this key role, it should apply certain security measures, including treating engagements as consulting services and applying all relevant standards. In this way, an internal audit will protect its independence and the objectivity of its assurance services