Is it important that internal audit annually reviews the company’s risk management function? What advice would you provide to a head of internal audit that was not performing such a review? Have you seen any examples where internal audit has conducted such reviews and if not, why do you think this to be the case?