Typically, risk audits are conducted by the internal audit team or an external auditing firm. The choice depends on the scope of the audit and the resources available within the organization. The audit committee usually oversees the process to ensure objectivity and thoroughness.