Why the Risk Based Internal Audit is so important

For many years Internal Audit considered itself as being solely involved in the controls and processes as they relate to the financial transactions of the firm. Often the internal audit function was considered as part of the review and inspection process in the business. In a way internal auditors often saw themselves and in-house versions of the external variety.

Internal audit did not start out that way. Years ago when I formally studied the subject at university the internal audit ‘bible’ was ‘The Practice of Modern Internal Auditing’ by Lawrence B. Sawer (published by the Institute of Internal Auditors, Inc. originally in 1973). This highly knowledgeable tome of almost 900 pages covered the full ambit of internal auditing in beautiful detail, with dozens of example of checklists and working specimens. These were examples of day-to-day operational risks across all sorts of industries. A small sample ranges from the audit of a highway transport department (covering equipment maintenance, vehicle dispatching, fuel, parts and repair services and general administration) to control and compliance over a range of branches at a major bank. I could go on-and-on, but I guess that you get the picture.

Today, however, the wheel seems to have travelled the full circle with the realization that the world is fraught with all sorts of risks and dangers and not just the financial kind.

So it is nice to see that Risk Based Internal Auditing (RBIA) is now specifically defined as a methodology that links internal auditing to a firm’s overall risk management framework. RBIA permits internal audit to provide assurance to the board that the firm’s risk management processes are managing risks effectively.

To make the differences absolutely clear let us take a short look at the essence of the traditional internal audit approach as opposed to that of RBIA (Risk Based Internal Audit)

The traditional approach’s focus is on;

1. The audit plan based on the audit cycle (which imposes a strict time duration).
2. Important risks may not be covered in the audit program.
3. Focusing on deficiencies in controls and cases of non compliance of the firm’s policies and procedures.
4. An understanding of the business unit operations is built through time consuming process mapping exercises and might rely on outdated policies and procedures manuals.

The Risk Based Internal Audit focus is on;

1. The audit plan based on the results of the business unit’s risk evaluation. Risky areas are covered first and far more frequently.
2. Provides assurance that important risks are being managed properly.
3. The focus is on risks that are not properly controlled and/or overly controlled.
4. Creates an in-depth understanding of the business unit operations through risk assessment workshops and with the participation of business unit management.

By tackling the task from a risk angle internal audit should be able to form an opinion as to whether;

• the firm’s management has identified, assessed and responded to risks within and beyond the organization’s risk appetite,
• that the responses to risks are effective but not excessive in managing inherent risks within this risk appetite,
• residual risks that are not in line with the risk appetite, are subject to action to remedy this,
• risk management processes, including the effectiveness of responses and the completion of actions, are being monitored by management to ensure they continue to operate effectively, and
• risks, responses and actions are being properly classified and reported.

To my mind this is certainly a most important step for the internal audit profession.

If you are in any way involved in the audit profession (either as an external or an internal auditor) or in the operational risk management or compliance fields you do need to hone you internal audit skills.