The risk management and internal auditing relationship: developing and validating a model