The role of internal audit in risk management