With respect to erm, which one of the following is not a legitimate role for internal audit?