Both public and private organisations are under pressure to identify, promptly assess, and adequately manage all risks. This study sought to investigate the contribution of internal audit to risk management in public institutions. It specifically examined the risk management practices of three selected public health institutions in Accra and Tema, ascertained the effectiveness of risk management practices in the selected institutions, and investigated the challenges to risk management and internal audit in the selected institutions. A mixed-method approach was used, it involved the use of questionnaires and interviews to gather data from administrative staff and management of the selected health institutions. The study revealed that selected health institutions (Achimota Hospital, Ridge Hospital, and Manhean Polyclinic) have in place various risk management practices, but they use a traditional approach and focused primarily on financial and operational risks. Internal auditing in health institutions helps to avoid financial loss and provides independent assurance that the risk management and governance structures function effectively in these organisations. The findings also revealed that risk management practices have so far not proven to be effective in driving organisational growth and sustainability. The main challenges are the weak implementation of audit recommendations, political interference, resource constraints, and poor reporting standards. This study concludes that the challenges to risk management and internal audit are systematic, hence, the Ministry of Health must institute reforms that would promote enterprise risk management as part of the organisational culture in health facilities.