Risk based internal auditing – an introduction Slides of figures and appendices ©David M Griffiths www.internalaudit.biz.

Slides:



Advertisements
Similar presentations
1 Introduction to Safety Management April Objective The objective of this presentation is to highlight some of the basic elements of Safety Management.
Advertisements

1 Welcome Safety Regulatory Function Handbook April 2006.
Objectives To introduce software project management and to describe its distinctive characteristics To discuss project planning and the planning process.
The Managing Authority –Keystone of the Control System
The Risk Management Process (AS/NZS 4360, Chapter 3)
1 Marsh Risk Profiling User Guide for all Schools and Departments.
Chapter 6 Negotiating access and research ethics
Chapter 13 Overall Audit Plan and Audit Program
Appendix H: Risk training slides (sample). What is Risk? “ Risk is the effect of uncertainty on objectives ” AS/NZS ISO31000:2009.
©Ian Sommerville 2004Software Engineering, 7th edition. Chapter 5 Slide 1 Project management.
Alignment of COBIT to Botswana IT Audit Methodology
Internal Control and Control Risk
1 Auditing in the Public Interest Records Management in the Victorian Public Sector Audit objective Audit had two objectives : The first objective was.
Risk based internal auditing – an introduction Slides of figures and appendices ©David M Griffiths V3.2 ©David M Griffithswww.internalaudit.biz.
How to Audit an ERP System via the Risk Management Route Presented by: Gabriel Lung ISACA London Chapter Events 2003/2004 ABN-AMRO, 250 Bishopsgate, London.
Institute of Municipal Finance Officers & Related Professions
Business Assurance Service An explanation of risk based auditing and reporting Anthony Garnett, Head of BAS February 2008.
©Ian Sommerville 2006Software Engineering, 8th edition. Chapter 5 Slide 1 Project management.
Risk-Focused Examinations David Vacca, Assistant Director – Insurance Analysis & Information Services, NAIC Welcome to the © 2009 The National Association.
Risk based internal auditing – an introduction Slides of figures and appendices ©David M Griffiths
By Saurabh Sardesai October 2014.
Auditing A Risk-Based Approach To Conducting A Quality Audit
Quality evaluation and improvement for Internal Audit
For more information visit us at Small Charities Coalition Risk management Catherine Rustomji Head of Third Sector North – Hempsons.
OH&S Management System
Challenges Faced in Developing Audit Plans and Programs 21 st March, 2013.
The role of internal audit in enterprise-wide risk management (ERM)
Equity Housing Group Risk Management. 05 August 2002 © MazarsEquity Housing Group: Risk Management 2 Agenda Introduction: what is Risk Management? The.
What is Risk Management - Panel Discussion Tony Whitworth Vice-President Finance & Resources.
INTERNAL CONTROL OVER FINANCIAL REPORTING
Chapter 5 Internal Control over Financial Reporting
Internal Control in a Financial Statement Audit
James Aiello PricewaterhouseCoopers Africa Utility Week 06 International Good Practice in Procurement.
Internal Control in a Financial Statement Audit
DEPARTMENT OF REGIONAL DEVELOPMENT, PRIMARY INDUSTRY, FISHERIES AND RESOURCES Mining Management Act Workshop and Information Session Mining Operations.
Learning Objectives LO5 Illustrate how business risk analysis is used to assess the risk of material misstatement at the financial statement level and.
©Ian Sommerville 2006Software Engineering, 8th edition. Chapter 5 Slide 1 Risk management.
Private & Confidential1 (SIA) 13 Enterprise Risk Management The Standard should be read in the conjunction with the "Preface to the Standards on Internal.
SANEDI. INDEX  KEY ACTIVITIES DURING FINANCIAL YEAR  DISCUSSIONS ON KEY ACTIVITIES  CONCLUSION  APPRECIATION.
Object-Oriented Software Engineering
RAWG.  Risk assessment guideline for strategic and annual planning ◦ Identifying auditing universe ◦ Identification of risks ◦ Categorization of possible.
Chapter 15: Risk Management
1 Internal Audit. 2 Definition Is an independent activity established by management to examine and evaluate the organization’s risk management processes.
The Role of Teaching Assistants. Session outline The Workshop includes four elements: (1)Roles and Responsibilities of Staff (2)Establishing a Professional.
1) Establish & Identify Scheme 5) Evolve Scheme 4) Review & Modify Scheme Deliverables 3) Operate the Framework 2) Manage Performance Assurance Scheme.
Professional Certificate in Electoral Processes Understanding and Demonstrating Assessment Criteria Facilitator: Tony Cash.
Practical Investment Assurance Framework PIAF Copyright © 2009 Group Joy Pty. Ltd. All rights reserved. Recommended for C- Level Executives.
CHAPTER 5 INTERNAL CONTROL OVER FINANCIAL REPORTING.
McGraw-Hill/Irwin © 2003 The McGraw-Hill Companies, Inc., All Rights Reserved. 6-1 Chapter 6 CHAPTER 6 INTERNAL CONTROL IN A FINANCIAL STATEMENT AUDIT.
Copyright © 2006 by The McGraw-Hill Companies, Inc. All rights reserved. McGraw-Hill/Irwin 6-1 Chapter Six Internal Control in a Financial Statement Audit.
TREASURY REGULATIONS’ CHANGES AND POTENTIAL IMPACT
Project Management Risk and Quality.
Risk Management and the Audit Plan abc CIPFA in the Midlands Audit Training Seminar Wednesday 24th November 2004 Tina Spiers.
PIC EU-28 Conference Paris, 26 – 27 November 2015 PIC An EU Approach Assurance Maps An Introductory workshop Nathan Paget United Kingdom.
1 Friday 26 th July 2013 Gibson Hotel Jason Dowling CPA RISK MANAGEMENT & CORPORATE GOVERNANCE.
ICAJ/PAB - Improving Compliance with International Standards on Auditing Planning an audit of financial statements 19 July 2014.
McGraw-Hill/Irwin © The McGraw-Hill Companies 2010 Internal Control in a Financial Statement Audit Chapter Six.
OHS Risk Assessment of Work
An Overview on Risk Management
Solihull Review of Urgent Care Programme Approach And Governance 2013
SA&S-Fortnightly Status Report – Overview Period Ending 3rd May 2017
Ensuring a safe workplace
11.3 Perform Qualitative Risk Analysis
Self Identified Issues
HUMAN RESOURCE GOVERNANCE, RISK MANAGEMENT AND COMPLIANCE
Risk management - HIRAC awareness presentation
Audit Risk Assessment Model
Insert Programme Name Risk Report to insert name Month Year.
Robin Youll Office for National Statistics
Corruption Risk Assessment
Presentation transcript:

Risk based internal auditing – an introduction Slides of figures and appendices ©David M Griffiths

©David M Griffithswww.internalaudit.biz Risk based internal auditing – an introduction slides of figures and appendices The following slides are those used in the book Risk based internal auditing – an introduction available from The slides of figures are: –1 Internal auditing objectives –2 Grid for significance risks –3 Stages of an audit –4 RBIA documentation –5 Processes involved in stage 2 –6 Grid for frequency of audits –7 Factors to reduce inherent risk scores risks –8 Processes involved in stage 3 –9 Grid for significance of residual risks Slides of appendices are –A Internal auditing objectives –B Hierarchy of objectives, risks and controls –C Process map –E Grid for risk workshop –J Stages of an internal audit –Other appendices are on the excel spreadsheet RBIA introduction excel v3

©David M Griffithswww.internalaudit.biz Internal auditing objectives (Figure 1 and appendix A) The main aim of internal auditing is to assist the organisation to achieve its objectives The management of an organisation have Objectives An internal control is a process which manages a risk A risk is a set of circumstances that hinder the achievement of objectives Internal auditing provides an independent and objective opinion to an organisation’s management as to whether its risks are being managed to acceptable levels.

©David M Griffithswww.internalaudit.biz 2 Grid for significance of risks Unacceptable: Immediate action required to manage the risk Issue: Action required to manage the risk Supplementary issue: Action is advisable if resources are available Acceptable: No action required Rare(1) Unlikely (2) Possible (3) Probable (4) Almost certain (5) 2 Acceptable Insignificant (1) Minor (2) Moderate (3) Major (4) Catastrophic (5) Likelihood of risk Consequence of risk 16 Unacceptable 3 Acceptable 2 Acceptable 1 Acceptable 5 Issue 3 Acceptable 5 Supplementary Issue 4 Acceptable 4 Acceptable 4 Acceptable 6 Supplementary Issue 6 Supplementary Issue 9 Issue 12 Issue 8 Supplementary Issue 8 Supplementary Issue 12 Issue 10 Issue 10 Issue 15 Unacceptable 20 Unacceptable 15 Unacceptable 20 Unacceptable 25 Unacceptable Risk appetite, as defined by the board IR RR IR = Inherent Risk RR = Residual Risk Internal control Fig.2 Grid showing the significance of risks

3 Stages of an audit ©David M Griffithswww.internalaudit.biz Assess risk maturity Feedback results into RAU Individual audit Management's Risk Register (if available) Audit plan Audit report Risk Naive Risk Enabled Risk Managed Risk Defined Risk Aware Use organisation's risks Facilitate risk identification Audit Committee report Stage 2 Stage 1 Audit universe Management's Risk Register (amended) Assign risks to audits Risk and audit universe (RAU) Stage 3 Fig 3 Stages of an audit

©David M Griffithswww.internalaudit.biz 4 RBIA documentation Fig. 4 RBIA documentation risks last audits scores controls Audit Committee report universe risks tests scores controls audit reports risk and audit audit databases risks last audits scores controls Audit Committee report risks tests scores controls audit reports objective s

5 Processes involved in stage 2 ©David M Griffithswww.internalaudit.biz Risks which will be tolerated Risks on which assurance is provided by others Risk and Audit Universe Filter risks Audit plan Risks on which assurance is required Risks within the risk appetite Risk Register (audited) Categorise risks Risks not requiring an audit in this period Link risks to audits Select risks to be covered Alllocate resources to audits Audit Universe Audit Committee report Fig 5 Processes involved in Stage 2

©David M Griffithswww.internalaudit.biz 6 Grid for frequency of audits Rare(1) Unlikely (2) Possible (3) Probable (4) Almost certain (5) 2 Never Insignificant (1) Minor (2) Moderate (3) Major (4) Catastrophic (5) Likelihood of inherent risk Consequence of inherent risk 16 Every year 3 Never 2 Never 1 Never 5 Every three years 3 Never 5 Every three years 4 Never 4 Never 4 Never 6 Every three years 6 Every three years 9 Every two years 12 Every two years 8 Every three years 8 Every three years 12 Every two years 10 Every two years 10 Every two years 15 Every year 20 Every year 15 Every year 20 Every year 25 Every year Fig. 6 Grid for the frequency of audits

©David M Griffithswww.internalaudit.biz 7 Factors to reduce inherent risk scores risks Green AmberRed 1 year 2 years 3 years Time since last audit Audit result Fig. 7 Factors to reduce inherent risk scores

8 Processes involved in stage 3 ©David M Griffithswww.internalaudit.biz Define draft audit scope Feedback results into risk and audit universe Set up an audit database to record the audit details, or update the Risk and Audit Universe Agreed scope Audit report Test the monitoring and proper operation of controls Audit plan Meetings to determine objectives, risks and agree scope Draw preliminary conclusions and discuss them Obtain relevant documentation on processes Audit database Examine the risk management process for the area audited Decide on audit approach Conclude on risk maturity for the area audited Risk and audit universe Fig 5 Processes involved in stage 3

©David M Griffithswww.internalaudit.biz 9 Grid for significance of residual risks Unacceptable: Immediate action required to control the risk Issue: Action required to control the risk Supplementary issue: Action is advisable if it is cost-effective Acceptable: No action required Rare(1) Unlikely (2) Possible (3) Probable (4) Almost certain (5) 2 Acceptable Insignificant (1) Minor (2) Moderate (3) Major (4) Catastrophic (5) Likelihood of residual risk Consequence of residual risk 16 Unacceptable 3 Acceptable 2 Acceptable 1 Acceptable 5 Supplementary Issue 3 Acceptable 5 Supplementary Issue 4 Acceptable 4 Acceptable 4 Acceptable 6 Supplementary Issue 6 Supplementary Issue 9 Issue 12 Issue 8 Supplementary Issue 8 Supplementary Issue 12 Issue 10 Issue 10 Issue 15 Unacceptable 20 Unacceptable 15 Unacceptable 20 Unacceptable 25 Unacceptable Risk appetite, as defined by the board Fig. 9 Grid for the significance of residual risks

©David M Griffithswww.internalaudit.biz Hierarchy of objectives, risks and controls (Appendix B) Devise a strategy for the next five years to deliver our objectives Relieve famine in central Africa No clear strategy as to how to achieve our objective Unable to predict where and when famines will occur Unable to obtain food Unable to deliver the food to the starving Do not have the staff and systems to support the operation Set up a system which enables us to predict famine areas Set up agreements with donors to obtain food Establish delivery systems to deliver food when and where it is required Establish functions to support the field operations Insufficient lorries to transport grain L orries break down Do not know where food is required most urgently Unable to obtain space on ships Insufficient drivers Roads are impassable Establish a supply chain to ensure prompt delivery of food to the highest priority area Decide how future needs are to be met, by local carrier or own lorries Lorries to be properly maintained Set up strategy for prioritizing camps Establish contacts with shipping companies to anticipate problems Identify how to recruit at short notice Set up possible alternativ e routes risks Objective level 1 risks Objective level 3 Objective level 2

©David M Griffithswww.internalaudit.biz Objectives map (appendix C) Relieve famine in central Africa 1 Devise a strategy for the next five years to deliver our objectives 2 Set up a system which enables us to predict famine areas 3 Set up agreements with donors to obtain food 4 Establish delivery systems to deliver food when and where it is required 5 Establish functions to support the field operations 4.2 Decide how future needs are to be met, by local carrier or own lorries 4.6 Set up strategy for prioritizing camps 4.1 Establish contacts with shipping companies to anticipate problems 4.4 Identify how to recruit drivers at short notice 4.5 Set up possible alternative routes for delivery objective 1.2 Communicate strategy 1.3 Deliver strategy 1.1 Agree a strategy 1.4 Update strategy 5.2 Provide financial advice 5.3 Provide transaction processing 5.6 Provide human resources 5.1 Raise money 5.4 Provide legal services 5.5 Provide information technology Level 2 objectives 4.3 Lorries to be properly maintained Level 3 objectives

©David M Griffithswww.internalaudit.biz Grid for risk workshop (appendix E) Rare(1) Unlikely (2) Possible (3) Probable (4) Almost certain (5) 2 Acceptable Insignificant (1) Minor (2) Moderate (3) Major (4) Catastrophic (5) Likelihood of risk Consequence of risk 16 Unacceptable 3 Acceptable 2 Acceptable 1 Acceptable 5 Issue 3 Acceptable 5 Supplementary Issue 4 Acceptable 4 Acceptable 4 Acceptable 6 Supplementary Issue 6 Supplementary Issue 9 Issue 12 Issue 8 Supplementary Issue 8 Supplementary Issue 12 Issue 10 Issue 10 Issue 15 Unacceptable 20 Unacceptable 15 Unacceptable 20 Unacceptable 25 Unacceptable

©David M Griffithswww.internalaudit.biz Stages of an internal audit (appendix J) Works with the business to identify risks hindering the processes Tests the controls mitigating the risks The management of an organisation have Objectives An internal control is a process which manages a risk A risk is a set of circumstances that hinder the achievement of objectives Significant risks generate the audit plan Internal auditing Internal auditing: provides an independent and objective opinion to an organisation’s management as to whether its risks are being managed to acceptable levels. Assures that risks are mitigated to an acceptable level 5 Determines processes and their objectives 1 Reports where risks are not sufficiently mitigated by controls The audit