Risk based internal audit

Risk based Internal Audit (RBIA) is an internal methodology which is primarily focused on the inherent risk involved in the activities or system and provide assurance that risk is being managed by the management within the defined risk appetite level.[1] It is the risk management framework of the management and seeks at every stage to reinforce the responsibility of management and BOD (Board of Directors) for managing risk.

Risk based internal audit is being conducted by internal audit department and helps the risk management function of the company by providing assurance about the risk mitigation. RBIA allows internal audit to provide assurance to the board that risk management processes are managing risks effectively, in relation to the risk appetite.[2]

Risk Capacity

Is the maximum amount of risk that an entity can bear which is linked to capital, liquid assets, borrowing capacity etc. Maximum amount of bearable risk by an entity.

Risk Appetite

It is the amount of risk that an entity (on broad level) willing to accept within its overall Capacity. It provides the threshold of acceptable risk and determining the risk appetite is continuous process, it can't be set once and leave. Risk appetite is developed on the basis of risk level of company like risk hunger company may develop high risk appetite while risk averse company may develop low risk appetite level.

Risk

Main article: risk

Risk is the potential of losing something of value, weighed against the potential to gain something of value. Risk hinders the achievement of objective and it has two attributes.

  1. Likelihood: Probability of Risk Event (P)
  2. Consequences: Impact of Risk Event (I)

In Risk based internal auditing two types of risks are considered.

Inherent Risk

Risk that is existed in the absence of any action or control or modification the event.

Residual Risk

Risk that remains after controls are implemented or we can say residual of inherent risk.

Risk register

Main article: risk register

It is a log that contains all of the information related to the risk management activities. It includes following details related to risk management activities.

It contains;

  1. Risks
  2. Potential Response
  3. Root Cause of Risks
  4. Risk categories and Ranking

Risk Assessment

Main article: Risk assessment

Allows an entity to understand the possibility and impact of risk event. Use two prospectives;

References

  1. Risk based internal auditing
  2. An approach to implementing Risk Based Internal Auditing

See also

This article is issued from Wikipedia - version of the Sunday, August 23, 2015. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.