Question

Summary of the issue of risk management in the context of internal auditing.

Answer 1

The internal audit and risk management have to work together, however it is essential that both report to separate senior managers, for clear governance goals and to ensure that neither role gets compromised. If the risk management framework is does not exist or not very strong, it indicates that the organisation’s system of internal control is very poor. An internal auditor must promote effective risk management practice to improve the system of internal control. The internal audit is influenced by risk management processes which impact on the audit universe and the risk assessment of relative risk. Thus it is vital that the risk management process must generate adequate information for internal audit to allow the development of plans of assurance and timetables, including the Internal Audit Plan. This information should include registers of the organisation’s risks, the associated controls, the assessment by management of the effectiveness of those controls, the likelihoods and consequences of each risk likely with such controls in their current state of effectiveness, and the potential exposure which an organisation might face from each risk were the controls to fail completely. To summarize the main areas of conflict among these two are:

1) Risk management develop the framework; and internal audit measure the effectiveness and adequacy of the risk management framework

2) Risk management advises management on integration into business operations and their roles in making it work; and internal audit check their commitment.

3) Risk management provide allocation of accountability for risks, controls and tasks; and the auditors audit whether accountable managers fulfil those responsibilities

4) Risk management act as a mentor and advisor to management on risk management issues; and internal auditor plays the role of an independent reviewer to give assurance on management’s performance and capability in risk management