Risk Based Internal Audit

RISK BASED INTERNAL AUDIT:

Risk assessment and risk-based audit planning

For Corporate internal audit, risk assessment is a key element in the development of the annual risk-based internal audit plan. The identification and prioritization of key organizational risks is critical to ensuring that internal audit resources are allocated to the areas that matter most.

This approach aims to ensure that internal audit resources are focused on the areas of highest risk, and potential issues will be flagged to management before they become problems.

First the organization as a whole is evaluated to understand the environment of the organization, the key business risks that need to be controlled and the challenges that the organization must deal with. Other information that is assessed at this point should include the culture of the organization, the strategic plan, the current year business plan, the financial plan, and areas of known issues from prior internal audit work, as well as forthcoming changes in legislation or regulations.

From the understanding of the corporate environment and the key risks, each business segment can be evaluated as to the degree of risk/complexity it presents. This would cover business units and support functions within an organization. Where the evaluation of the business unit suggests high risk, further audit examination can continue looking at specific risks and in turn the controls in place to mitigate specific risks. Where a unit and its business processes are evaluated as presenting low risk to the organization as a whole, no further audit effort would be expended.

Risk Evaluation.

The purpose of the risk evaluation is to identify the inherent risk of performing various business functions. Audit resources will be allocated to the functions with the highest risk. The risk evaluation will directly affect the nature, timing and extent of audit resources allocated.

The two primary questions to consider when evaluating the risk inherent in a business function are:

• What is the probability that things can go wrong? (The probability of one event)

• What is the cost if what can go wrong does go wrong? (The exposure of one event)

Risk is evaluated by answering the above questions for various risk factors and assessing the probability of failure and the impact of exposure for each risk factor. Risk is the probability times the exposure.

The risk factors inherent in business include the following:

* access risk* business disruption risk

* credit risk* customer service risk

* data integrity risk* financial/external report misstatement risk

* float risk* fraud risk

* legal and regulatory risk* physical harm risk

These risk factors cause potential exposures. The potential exposures include (but are not limited to):

* financial loss

* legal and regulatory violations/censorship

* negative customer impact

* loss of business opportunities

* public embarrassment

* inefficiencies in the business process