D, is an internal auditor of a listed company. The company wants to make sure that it is in compliance with SEBI requirements at all times and it is never on the wrong side of the law. It asks its internal auditor to man

At times, the Internal Auditor is exposed to a different type of risk to independence, whereby management seeks active business support from the Internal Auditor. Apart from providing basic assurance and advisory inputs, the Internal Auditor is assigned certain responsibilities (such as risk management, system automation, process reengineering, etc.). Although some limited operational role may be acceptable with due approvals, and for a short duration, the Internal Auditor shall do so only after communicating his limitations along the following lines: Unable to assume ownership or accountability of the process; and Inability to take operational decisions which may be subject to an internal audit later on. The Internal Auditor does not assume responsibility to manage or operate the compliance framework or to take compliance-related decisions. It is not responsibility of the Internal Auditor to execute or resolve compliance related risks (e.g., engaging directly with regulators, etc.). Although internal audit function provides independent assurance to enhance governance (which includes compliance with laws and regulations), it does not assume operational responsibility of its compliance framework. It is the responsibility of the management. Internal auditor is responsible for auditing the compliance framework and not managing it. Similarly, he does not accept compliance related risks like directly engaging with regulator which is outside his scope and responsibility. If the management asks internal auditor to assume additional roles and responsibilities that may impair, or appear to impair, the organizational independence of the internal audit activity, the same should be reported to the audit committee and board as well.