Going beyond the traditional internal audit approach to risk