Scribd
Upload
135 views

Execute A Risk Assessment

Uploaded by

Rhea Simone
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
135 views

Execute A Risk Assessment

Uploaded by

Rhea Simone
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

IIA Audit Tool

Category: Professional
Purpose: How To

Risk Engagement
Gather Information Planning Reporting
Assessment Execution

This tool references specific standards from the International Standards for the Professional Practice of Internal
Auditing. Additionally, internal auditors are encouraged to consult the IIA Practice Guide, Engagement Planning:
Establishing Objectives and Scope, which provides detailed information about building upon the risk assessment to
develop the engagement objectives and scope.

Because any single internal audit engagement cannot cover every risk, internal auditors assess the significance of
the risks identified by management, during previous internal audit engagements, and audits or assessments of other
internal or external entities or consultants as described in Standard 2050 – Coordination and Reliance.

Standard 2210 – Engagement Objectives states that objectives must be established for each engagement, and
Standard 2210.A1 requires a preliminary assessment of the risks relevant to the activity under review. Internal
auditors may interview relationship owners, business managers, procurement managers, legal personnel, and other
relevant personnel who have technical knowledge that can assist in identifying risks to the area or process under
review.

The internal audit activity is responsible for assessing the quality of management’s risk management framework and
processes to determine whether it is adequate in design and/or operation. Management’s risk management
processes should account for not only the financial, operational, and regulatory impact of risks, but also nonfinancial
impacts, such as damage to the organization’s reputation or relationships with customers. Even a small, contained
information breach can have a damaging impact on an organization’s reputation depending on the nature of the
breach. Some risks may appear insignificant on their own but should be considered in the context of the
organization’s overall risk management framework and process.

Internal audit activities vary in how they assess risk for their engagements. One effective way to perform and
document an engagement-level risk assessment is to leverage assessments that have already been completed as
long as they are within a reasonable time frame. Collect the appropriate documents and review them along with
management’s risk assessment documentation to ensure the risks as viewed by internal audit and management are
(reasonably) the same.

Consider creating a risk matrix listing the relevant inherent risks (e.g., risks that could exist if internal controls are not
applied), expanding the matrix to include measurement of the risk exposure when including the effectiveness of
relevant controls. A risk matrix may be created using a spreadsheet or similar document, with or without a software
program. The format of the matrix may vary but typically includes a row for each risk and a column for each risk
measure, such as impact and likelihood.

Once the internal audit activity has assessed the level of risk exposure presented to the organization by its risk
management framework and processes, the engagement risk matrix will result in a basic graph that may suggest
areas for further explanation. These may also be useful as heat maps.

If using heat maps and/or risk and control matrices in an assessment, include them in the engagement workpapers
within the preliminary risk assessment, supporting the internal audit activity’s decisions about risk significance and in
conformance with Standard 2330 – Documenting Information.

1
Implementation Guide 2210 ‒ Engagement Objectives states, “During engagement planning, it is helpful for internal
auditors to develop a planning memo, where they can document the objectives, scope, risk assessment, and
prioritized areas for testing.” In addition, heat maps and risk and control matrices will lend support to the engagement
results and conclusions.

ABOUT THE IIA


The Institute of Internal Auditors (IIA) is the internal audit profession’s most widely recognized advocate, educator, and provider of standards,
guidance, and certifications. Established in 1941, The IIA today serves more than 200,000 members from more than 170 countries and territories.
The association’s global headquarters is in Lake Mary, Fla. For more information, visit www.theiia.org.

COPYRIGHT
Copyright © 2021 The Institute of Internal Auditors, Inc. All rights reserved. For permission to reproduce, please contact [email protected].

March 2021

You might also like