Continuous Business Risk Assessment

About BYU Private, Church-sponsored Founded 1875 Three campuses –Provo, Utah (30,000) –Rexburg, Idaho (14,000) –Laie, Hawaii (2,000) Internal Audit: 11 professionals, –10 associate (student) auditors

Why? Our current risk assessment model is It no longer enables us to keep up with emerging risks in a dynamic business environment; Assumes management/auditor omnipotence One year cycle time is just tooooo long to formally address risks Relies on single method of harvesting risk information (annual survey) No method for prioritizing work Annual audit plan becomes the “Hotel California” of audit projects Risks working with blinders on.

Why? Comply with IIA Performance Standards Ensure alignment with University mission and objectives Add value to our audit customers

Are you following, unchanged, the audit plan you developed for 2003? Questions “Most often used measures (of internal audit effectiveness) are absolutely dysfunctional. I think of one: you do your annual audit plan and commit to the audit committee that you’re going to do X number of these audits for the coming year.” --Dr. James Roth

Internal Auditing Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

Best Practices Extensive Staff Expertise Challenging Work Environment Organizational Alignment Participative, Qualitative, Real-time Risk Assessment An Array of Audit Services February 2003 Internal Auditor

Array of Audit Services Risk-based audits – working with management to identify the business risks they face. Process audits – auditing an entire business process rather than an organizational unit and looking for ways to improve the process instead of simply trying to find control weaknesses. Pre-implementation reviews – participating on new-product or system-development teams and/or reviewing the project at certain defined milestones. Self-Assessment – hosting workshops, administering questionnaires, and conducting structured interviews to address soft controls. Internal-Control Education – formal training programs designed and taught by internal auditors, as well as ad-hoc training, when needed, during assurance or consulting projects.

Internal Audit Tools Control Self-Assessment Workshops Client-Relationship Management –Relationship Development –Client Training Control Model Mentoring Computer-Aided Exception Identification (Continuous Auditing) Process Improvement Programs (Quality Improvement, Continuous Improvement) –Team Facilitation –Improvement Models

Internal Audit Tools Process Mapping/Control Evaluation (SOx, FCPA) Risk-based Auditing Maturity Model Evaluation/Implementation Management Review Risk Management Council Improvement Models –Accountability –Continuous Improvement

Continuous Business Risk Assessment Continuous Risk Assessment is a participative process whereby we evaluate emerging risks on a continuous, qualitative, real-time basis rather than on an annual basis.

Participative Involve more than Internal Auditors Seek out managers and employees who know and understand emerging risks.

Continuous Periodic vs. Annual As frequently as needed Various sources of information (meeting, conference, workshop, survey, interview)

Qualitative Relies on professional judgment Includes political and strategic factors as well as traditional measures Involves more than one opinion

Real-Time Results in changes to the audit schedule NOW Decisions made in close proximity to issue and risk identification

Event Identification Risk Assessment Process Imp. Action Plan Audit Mgt. Review Risk Response R i s k Risk Assessment Process Risk Evaluation & Response Investigation Mgt. Conf. Control Doc.

Seven Performance Standards Managing the Internal Audit Activity Nature of Work Engagement Planning Performing the Engagement Communicating Results Monitoring Progress (Recommendations) Management’s Acceptance of Risks

Audit Population Strengthening Control Environment Monitoring Compliance Risk-Based Audits & Requested Services

CBRA Event/Project Identification Risk Assessment Risk Response Prioritize Projects

CBRA Event/Project Identification Risk Assessment Risk Response Prioritize Projects

Risk Tracking Log Access Database Three Screens Input Log Evaluation Screen Strategic Considerations

Audit Project Portfolio Excel Categorized

What We Get Increased capability to systematically respond to business risks Increased ability to identify risks by expanding and improving risk information harvesting methods Improved utilization of Internal Audit resources Compliance with IIA Performance Standards Overall, a more mature risk assessment process

Standards Summary Risk-based plan of engagements Develop at least annually Determine priorities consistent with organization’s goals Consider input of senior management and board Identify significant exposures to risk Consider consulting proposals

Impacts More time identifying, characterizing and evaluating risks. Need more flexible audit schedule. Trust in consensus/professional opinion.

Copy of slide presentation Access database template (Tracking Log)

Continuous Business Risk Assessment