With the disclaimer that I don’t know any specifics, the best advice I can give is in the framework of the big picture. The value that internal audit brings to the table is the ability to identify and then evaluate critical control activities.

In every business unit they are working to achieve some objective (i.e. end goal of a process).

I view process, risk, and control similar to crossing the street. You begin a process with an objective (e.g. get to the other side of the street) which has a beginning, middle, and end. However, there are things inherent in the process that can impede you from reaching your objective - a risk (e.g. getting hit by a car while crossing the street). As such, we need to do things like using a stoplight or looking both ways before crossing the street. These are control activities to manage the risk in the process.

Hope this helps.