A Risk-Based Internal Audit (RBIA) is focused on the organization’s response to the risks they face in achieving their goals and objectives. An RBIA differs from other types of audits as it is based on the business goals and their associated risks. With this approach, internal auditors gain other responsibilities — now they not only manage the control activities, but also add an important contribution in the development of the risk management processes by defining the organization’s universe of risk. This article focuses on RBIA and describes a method to select the high-risk fields via risk assessment as a focal point. This provides time and cost saving in the audit because other controls with minor impacts to the business risk are placed in a different “bag.”
Benefits of conducting an RBIA
Writing in the European Journal of Accounting Auditing and Finance Research, Dr. Vahit Ferhan Benli and Duygu Celayir summed up the idea of a risk-based internal audit: “RBIA is an audit approach on the basis of determining the risk profiles of the businesses, shaping the audit progress according to the risk profile of the business and allocating the audit resources according to this profile to improve the efficiency of the audit.” The RBIA is an approach that enables the internal audit review to become more efficient and focused on the business needs and, consequently, a service under analysis. In this sense, management will benefit from greater input into the “shape” of the audit review, ensuring that key concerns and significant risks are considered within the scope of the audit. Risk management is a challenging landscape that requires adaptation of auditors, as every organization has a different attitude towards risk, different structures, processes and languages. For this reason, an RBIA seeks to reinforce all the responsibilities of risk management and establish a strong and well-designed risk management framework. Business plans are changed daily, and this represents a big challenge for RBIA, as there is no consensus on the best approach to implement it. Because of this, it is more difficult to manage RBIA than traditional IA approaches (a subject discussed below). To define a right risk management process and conduct a RDIA, it is crucial to understand the business needs in order to define internal controls that can reduce risks at an acceptable level — the risk appetite of the organization. According to David Griffiths in “Risk-Based Internal Auditing: Three views on compliance,” in order to conduct an effective RBIA directors need to ensure that the risk management framework includes the following:
Directors have identified and evaluated the risks that threaten the objectives of the organization and have developed an internal control system to reduce this threat to below the risk appetite, or report to the board where this is not possible The inherent risks are recorded and assessed in some way, allowing them to be classified in order of threat The board has approved a risk appetite for the organization on such a basis that risks can be easily identified as being above, or below, the risk appetite The responsibility for providing assurance on the risk management framework is defined. This will include defining the responsibilities of management, external audit, internal audit and any other functions that provide assurance, such as HR, Finance, Loss Prevention and the department of Health and Safety
The way to score risks is to attribute a level (e.g., high, medium and low) to the consequence and likelihood of the risk. According to CA Shiva Chaudhari in “A Guide to Risk-Based Internal Audit System in Banks,” there are immediate benefits when a RBIA is used. Table 1 depicts some of those benefits.
Table 1: Benefits of an RBIA
RBIA versus traditional internal audit
RBIA is an approach that requires extensive knowledge of the business and its risks, so it is often defined as being quite complex. Table 2 below presents a comparison between an RBIA and the traditional approach of internal audits (IA).
Table 2: RBIA versus traditional internal audit (IA)
RBIA stages
The implementation of an RBIA is generally done in three stages, which are described below. Stage 1: Assessing risk maturity In this stage, an overview is obtained from administration and board regarding the assessment, management and risk monitoring. This procedure is an indicator of the reliability of the risk for audit planning purposes. Stage 2: Periodic audit planning An audit is planned for a specific period (typically annual) where all areas on which the board requires objective assurance are identified and prioritized. Here, the risk management processes, the management of key risks and the recording and reporting of risks (audit results) are included. Stage 3: Individual audit assignments At this stage, individual risk-based assignments to provide assurance on part of the risk management framework are executed: For instance, on the mitigation of individual or groups of risks.
Conclusion
Economic and social life have expanded in unexpected ways recently, and the volume of business has expanded greatly to match them. This means more and greater risks. Controlling each process in terms of both time and resources has been an arduous task, and this has raised the costs of audits. For this reason, organizations should consider implementing RBIA processes to protect their assets from unnecessary risks, as it provides a 360º vision of the business. The key for success is always related to the first analysis performed, typically by internal auditors that analyze business goals, business objectives and their associated risks in order to conduct the IA in the best way. To conclude, businesses are becoming more complex and gigantic and a careful analysis of potential risks is needed in order to save organizations from unexpected threats which may interfere with their daily operations.
Sources
Dr. Vahit Ferhan Benli and Duygu Celayir, “Risk Based Internal Auditing and Risk Assessment Process,” European Journal of Accounting Auditing and Finance Research Risk Based Internal Auditing: Three views on implementation, David Griffiths Risk based internal auditing, Chartered Institute of Internal Auditors Best Practices in Risk-Based Internal Auditing, Sheryl Vacca Risk Based Internal (RBIA), Arun District Council
