Enterprise Risk Management (ERM) is an activity undertaken by many organizations. Jiffy Sportswear, Inc., is a fast growing privately owned company that will soon issue its shares to the public and be subject to SEC jurisdiction. Its CEO wants to implement a corporate wide ERM program and asks you, the CAE, to counsel him on the following:

1. Explain the purpose of ERM and how it may add value to the organization.
2. What is the role of internal auditing with respect to ERM? Moreover, what should internal auditing refrain from doing with respect to ERM?
3. Explain the concept of risk-based auditing and how it relates to ERM.