Register now or log in to join your professional community.
Risk Based Audits is an approach for performing audits with a particular focus on risky areas that have potential impact on Company's operations and financial growth. As a first step towards Risk Based Audits, Internal Audit prepares risk based audit plan by compiling audit universe and assessing risks for all processes / areas mentioned in the audit universe. Next step, IA conducts audits as per audit plan and highlights observations with causes, risks and priority so that management can focus on those risky areas and action to make processes more controlled.
A risk-based audit approach is designed to be used throughout the audit to efficiently and effectively focus the nature, timing and extent of audit procedures to those areas that have the most potential for causing material misstatement(s) in the financial report.
The risk-based approach requires the auditor to first understand the entity and its environment in order to identify risks that may result in material misstatement of the financial report. Next, the auditor performs an assessment of those risks at both the financial report and assertion levels. The assessment involves considering a number of factors such as the nature of the risks, relevant internal controls and the required level of audit evidence.
The result of the assessment effectively categorises the audit into a) areas of significant risk of material misstatement that require specific responses and b) areas of normal risk that can be addressed by standard audit work programs. Having assessed risks, the auditor then designs appropriate audit responses to those risks in order to obtain sufficient appropriate audit evidence on which to conclude. Risk assessment continues throughout the audit and the audit plan and procedures are amended where a reassessment is necessary.
Risk based internal auditing is an approach in which you perform internal audits in the perspective of risks associated with different operations, processes and organisation. For Example: you are auditing purchase cycle. Now consider all the risks involved in the process of purchasing, Think like what can go wrong in the process of purchasing. Identify all risks associated with purchases and address them during the audit.
Risk-based audit conceptually is to audit the things that really matter to your organisation. Which are the issues that really matter? Probably those areas that pose the greatest risks.
In case of system based approach, we start from controls but in case of risk based, our focus is the business objectives and not the controls. The best preparation for this type of audits is to assess the risk significant to the business of the Company and determining risk appetite of an organization.
Risk Based Audit is a methodology that links internal auditing to an organisation's overall risk management framework. Risk Based Audit allows internal audit to provide assurance to the board that risk management processes are managing risks effectively, in relation to the risk appetite.
The implementation and ongoing operation of Risk Based Audit has three stages and we have produced detailed guidance on each of them:
