ISO 31000 defines the responsibilities for risk management. For example, the organization's approach to assessing and responding to risk is the responsibility of The internal audit activity. The board. Management. The audit committee