Risk based internal auditing (RBIA) is at the cutting edge of internal audit practice and the activities involved in managing risks have been recognised as playing a central and essential role in maintaining a sound system of internal control. It is an area that is evolving rapidly and where there is still little consensus about the best way to implement it. This guidance explains why RBIA should be introduced, how it can be implemented and the advantages of RBIA. It is not intended as an internal audit manual, rather it focuses on those areas where RBIA requires different actions from other internal audit methodologies. The authors have drawn up the guidance with reference to their own practical experience, and that of other internal auditors in a wide range of organisations. The Institute hopes that its publication will stimulate further debate on the subject.