The development of the internal audit function has gone through many phases, from control-based audits to risk-based audits. While internal audit based on controls focused at strengthening the existing control mechanisms, giving recommendations on how to upgrade control procedures, risk based internal audit is based on identifying and assessing risks that would adversely affect the achievement of business goals. By identifying the risks, the entries in the plan of business activities priorities, that will be the subject of internal audit in the following year are determined. Internal auditing, reviewing and giving recommendations, is an effective support to risk management organizations, but the management structure is the one that makes decisions and is responsible for the risk management process.