Successfully Implementing Risk-based Audit

Risk Management Techniques Applied to Audit Practices

Dec 7, 2008

The key to the change in the audit industry is the emergence of risk management. This article will help the reader implement the risk perspective in audit work.

The last decade has seen an explosion of activity in the financial markets with unprecedented growth and then the resultant crash. Large banks have been hit heavily with credit, investment and accounting failures. All banks have had to deal with revised accounting standards and changes in regulatory compliance. The audit profession has also experienced significant change.

Internal Audit's Role in Risk Management

Internal audit’s role in risk management can be debated, but most organizations and the industry itself believe that the role of the audit department is to validate that controls are working. Business owners own risk, they establish their tolerances and appetites and then they implement controls. Often they ask audit to verify that those controls work.

How internal audit does that is the subject of this series of articles. How does the audit manager install methodologies for guaranteeing success in establishing a risk-based audit process. These articles will explain how to develop risk models for categorizing your audit universe; how to create audit entities, ensure that the audit plan addresses the risks of the organization, determine what type of auditor is needed, how to incorporate a monitoring process of value and how to write meaningful and impactful issues.

These articles should provide a basic, but good, understanding of risk-based auditing techniques that can help in moving an audit group forward and ensuring a valued contribution for many years to come.

So, where does one start when defining risk-based auditing? So much has changed in the past few years that many different definitions are floating around. It is difficult to not get confused. For our purposes risk-based auditing is simply “applying some methodology to the audit process that will help the auditor focus on what is important.”

With that definition in mind, there are certain steps that must be taken before actual application of the methodology defined. First step: understanding the audit universe.

Understanding the audit universe is not an easy task. There are organizations, and sub-organizations, to understand. There are structures and management personality. There is also impact from regulations, industry standards, and other external forces. There is a need to understand growth plans, products, strategies, history and inter-relations between the different parts of the organization. And just as important, we need to understand the culture of the organization.

The next installment of this series will talk more about the audit universe and provide several tips or secrets of success to help guide the reader through this important process. Once that step is completed one can begin to explore all the other items he or she will need to know to ensure successful implementation of risk based auditing.

The copyright of the article Successfully Implementing Risk-based Audit in Business Management is owned by Daniel Clark. Permission to republish Successfully Implementing Risk-based Audit in print or online must be granted by the author in writing.