Risk Managers and Internal Auditors: Two Roles, One Purpose | Farnoosh Davatgarzadeh
Updated: Oct 1
By Farnoosh Davatgarzadeh — Risk and Financial Markets Specialist
Guest essay submitted to Burj Al Wasl on 29 September 2026. English translation of the author's Persian text.
In most organizations, two figures come to mind whenever risk is discussed: the risk manager and the internal auditor. Many consider them interchangeable, or at least assume that their work is essentially the same. That misunderstanding can quietly weaken an organization's foundations.
The risk manager stands in the field of action. This person must identify and assess risks and uncertainties, establish boundaries, and work alongside managers to help determine which risks to accept and which to avoid in pursuit of organizational objectives.
The internal auditor stands a step back, deliberately rather than through neglect. The auditor's task is to tell the board whether that field is being managed properly. If auditors take on responsibility for managing risk themselves, they can no longer judge that same work impartially. No one can be both player and referee. Independence is therefore the internal auditor's most valuable asset.
Who, then, succeeds in the realm of risk? In my view, those who bring together several qualities.
First, they understand the language of numbers and are not intimidated by it. Risk ultimately needs to be assessed. Someone unable to estimate the likelihood and magnitude of a loss is reporting anxiety rather than risk.
Second, they know the business from close experience. Risk does not live in spreadsheet rows and columns. It takes shape in a weak contract, a supplier who suddenly withdraws, or a rushed decision. Anyone who does not understand where the organization's capital comes from and where it flows cannot fully understand where it might be lost.
Third, they trust numbers, but never blindly. Every calculation rests on assumptions, and some of the greatest dangers emerge when those assumptions prove wrong. A precise number brings a deceptive sense of comfort, which can itself become a dangerous trap.
Fourth, and perhaps most importantly, they have the courage to say no—and know how to say it so that others listen. A risk manager who always agrees with the group is effectively absent. A risk buried in complex language that the board cannot understand might as well never have been reported.
Success in this field comes neither from one particular qualification nor from a single skill. It grows from precision, understanding, measured skepticism and courage. Those who combine these qualities, whether risk managers or internal auditors, create value that no model can replace.
Author profile: https://www.linkedin.com/in/farnoosh-davatgarzadeh-a482131a9/
Read more perspectives in our guest analysis section.
Comments