Transcript Risk based internal auditing – an introduction slides of

Risk based
internal auditing
– an introduction
Slides of figures
and appendices
©David M Griffiths
©David M Griffiths
www.internalaudit.biz
Risk based internal auditing – an introduction
slides of figures and appendices
• The following slides are those used in the
book Risk based internal auditing – an
introduction available from
www.internalaudit .biz
• The slides of figures are:
–
–
–
–
–
–
–
–
–
1
2
3
4
5
6
7
8
9
Internal auditing objectives
Grid for significance risks
Stages of an audit
RBIA documentation
Processes involved in stage 2
Grid for frequency of audits
Factors to reduce inherent risk scores risks
Processes involved in stage 3
Grid for significance of residual risks
• Slides of appendices are
–
–
–
–
–
A Internal auditing objectives
B Hierarchy of objectives, risks and controls
C Process map
E Grid for risk workshop
J Stages of an internal audit
–
Other appendices are on the excel spreadsheet RBIA introduction excel v3
©David M Griffiths
www.internalaudit.biz
Internal auditing objectives
(Figure 1 and appendix A)
The
management
of an
organisation
have
Objectives
Internal auditing
provides an independent and
objective opinion to an
organisation’s management as to
whether its risks are being managed
to acceptable levels.
The main aim of internal
auditing is to assist the
organisation to achieve its
objectives
An
internal control
is a process which
manages a risk
A
risk
is a set of
circumstances
that hinder the
achievement of
objectives
©David M Griffiths
www.internalaudit.biz
Probable (4) Almost certain (5)
4
Acceptable
Supplementary
Issue
Possible (3)
IR
10
Issue
3
Acceptable
Supplementary
Issue
9
Issue
Unlikely (2)
5
Supplementary
Issue
2
Acceptable
4
Acceptable
6
8
Supplementary
Issue
Supplementary
Issue
10
Issue
1
Acceptable
2
Acceptable
3
Acceptable
4
Acceptable
5
Issue
Rare(1)
8
6
Insignificant (1)
Minor (2)
15
20
25
Unacceptable
Unacceptable
Unacceptable
12
Issue
16
20
Unacceptable
Unacceptable
12
Issue
15
Internal control
Likelihood of risk
2 Grid for significance of risks
RR
Moderate (3)
Major (4)
Unacceptable
Catastrophic (5)
Consequence of risk
Unacceptable: Immediate action required to manage the risk
Issue: Action required to manage the risk
Supplementary issue: Action is advisable if resources are available
Acceptable: No action required
Risk appetite, as defined by the board
IR = Inherent Risk
RR = Residual Risk
Fig.2 Grid showing the significance of risks
©David M Griffiths
www.internalaudit.biz
3 Stages of an audit
Management's
Risk Register
(if available)
Risk Enabled
Risk Naive
Risk Aware
Assess risk
maturity
Risk Managed
Stage 1
Risk Defined
Facilitate risk
identification
Audit universe
Management's
Risk Register
(amended)
Use organisation's
risks
Assign risks to
audits
Stage 2
Risk and audit
universe
(RAU)
Audit plan
Audit Committee
report
Individual audit
Audit report
Feedback results
into RAU
Fig 3 Stages of an audit
©David M Griffiths
www.internalaudit.biz
Stage 3
4 RBIA documentation
risk and audit
universe
audit databases
objectives
objectives
risks
risks
scores
scores
controls
controls
last audits
tests
Audit
Committee
report
audit
reports
Fig. 4 RBIA documentation
©David M Griffiths
www.internalaudit.biz
5 Processes involved in stage 2
Risk Register
(audited)
Risks on which
assurance is provided
by others
Risks within the risk
appetite
Filter risks
Risks not requiring an
audit in this period
Risks which will be
tolerated
Risks on which
assurance is
required
Categorise risks
Audit Universe
Link risks to
audits
Risk and Audit
Universe
Select risks to
be covered
Alllocate
resources to
audits
Audit plan
©David M Griffiths
Fig 5
www.internalaudit.biz
Processes
involved in Stage 2
Audit Committee
report
10
Every two
years
4
Never
8
12
Every three
years
Every two
years
Possible (3)
3
Never
6
9
12
Every three
years
Every two
years
Every two
years
Unlikely (2)
Probable (4) Almost certain (5)
5
Every three
years
2
Never
4
Never
6
8
10
Every three
years
Every three
years
Every two
years
1
Never
2
Never
3
Never
4
Never
Every three
years
Rare(1)
Likelihood of inherent risk
6 Grid for frequency of audits
Insignificant (1)
Minor (2)
15
20
25
Every year
Every year
Every year
Moderate (3)
16
20
Every year
Every year
Major (4)
15
Every year
5
Catastrophic (5)
Consequence of inherent risk
Fig. 6 Grid for the frequency of audits
©David M Griffiths
www.internalaudit.biz
3 years
0.75
1
1
2 years
0.5
0.75
1
0.25
0.5
0.75
1 year
Time since last audit
7 Factors to reduce inherent risk scores risks
Green
Amber
Red
Audit result
Fig. 7 Factors to reduce inherent risk scores
©David M Griffiths
www.internalaudit.biz
8 Processes involved in stage 3
Audit plan
Define draft audit
scope
Examine the risk
management process
for the area audited
Conclude on risk
maturity for the
area audited
Decide on audit
approach
Meetings to determine
objectives, risks and
agree scope
Agreed scope
Obtain relevant
documentation on
processes
Risk and audit universe
©David M Griffiths
Set up an audit database
to record the audit
details, or update the
Risk and Audit Universe
www.internalaudit.biz
Audit
database
4
Acceptable
Supplementary
Issue
15
20
25
Unacceptable
Unacceptable
12
Issue
16
20
Unacceptable
Unacceptable
Possible (3)
10
Issue
3
Acceptable
Supplementary
Issue
9
Issue
12
Issue
Unacceptable
Unlikely (2)
Probable (4) Almost certain (5)
5
Supplementary
Issue
Unacceptable
2
Acceptable
4
Acceptable
6
8
Supplementary
Issue
Supplementary
Issue
10
Issue
1
Acceptable
2
Acceptable
3
Acceptable
4
Acceptable
Supplementary
Issue
Rare(1)
Likelihood of residual risk
9 Grid for significance of residual risks
8
6
Insignificant (1)
Minor (2)
Moderate (3)
Major (4)
15
5
Catastrophic (5)
Consequence of residual risk
Unacceptable: Immediate action required to control the risk
Issue: Action required to control the risk
Supplementary issue: Action is advisable if it is cost-effective
Acceptable: No action required
Risk appetite, as defined by the board
Fig. 9 Grid for the significance of residual risks
©David M Griffiths
www.internalaudit.biz
Hierarchy of objectives, risks and controls
(Appendix B)
Objective level 1
Relieve famine in
central Africa
Risks level 1
No clear
strategy as
to how to
achieve our
objective
Unable to
predict where
and when
famines will
occur
Set up a
system which
enables us to
predict
famine areas
Unable to
obtain food
Unable to
deliver the
food to the
starving
Do not have
the staff and
systems to
support the
operation
Set up
agreements
with donors
to obtain
food
Establish a
supply chain to
ensure prompt
delivery of food
to the highest
priority area
Establish
functions to
support the
field
operations
Objective level 2
Devise a
strategy for
the next five
years to
deliver our
objectives
Don't distribute food
efficiently and
effectively
Risks Level 2
Objective level 3
Insufficient
lorries to
transport
grain
Fuel not
available
for lorries
Arrange land
transport
Lorries
break
down
Insufficient
drivers
Roads are
impassable
Do not know
where food is
required
most urgently
Lorries to
be properly
maintained
Identify
how to
recruit at
short
notice
Set up
possible
alternative
routes
Set up
strategy for
prioritizing
camps
Internal controls
Decide how
future needs
are to be
met, by
local carrier
or own
lorries
Attempt to
buy in
stocks
©David M Griffiths
www.internalaudit.biz
Objectives map
(appendix C)
objective
Relieve famine in
central Africa
Level 2 objectives
1
Devise a
strategy for
the next five
years to
deliver our
objectives
2
Set up a
system which
enables us to
predict
famine areas
3
Set up
agreements
with donors
to obtain
food
4
Establish
delivery
systems to
deliver food
when and
where it is
required
5
Establish
functions to
support the
field
operations
Level 3 objectives
1.1
The trustees
of the charity
define the
future aims
and plans
1.2
Tell all staff
about the
strategy
1.3
The strategy
is converted
into targets
and action for
all staff
1.4
Aims and
plans to be
regularly
updated
4.1
Arrange sea
transport
5.1
Raise money
5.2
Provide
financial
advice
©David M Griffiths
5.3
Provide
transaction
processing
4.2
Arrange land
transport
5.4
Provide legal
services
www.internalaudit.biz
5.5
Provide
information
technology
5.6
Provide human
resources
Grid for risk workshop
4
Acceptable
Supplementary
Issue
2
1
Unacceptable
Unacceptable
12
Issue
16
20
Unacceptable
Unacceptable
3
Acceptable
Supplementary
Issue
9
Issue
12
Issue
15
2
Acceptable
4
Acceptable
6
8
Supplementary
Issue
Supplementary
Issue
10
Issue
1
Acceptable
2 3
Acceptable
3
Acceptable
4
Acceptable
5 4
Issue
Insignificant (1)
8
6
Minor (2)
Moderate (3)
Major (4)
Consequence of risk
©David M Griffiths
www.internalaudit.biz
25
5
20
Possible (3)
10
Issue
Unlikely (2)
Probable (4) Almost certain (5)
5
Supplementary
Issue
15
Rare(1)
Likelihood of risk
(appendix E)
Unacceptable
6
Unacceptable
Catastrophic (5)
Stages of an internal audit (appendix J)
The
Internal auditing
of an
organisation
have
Internal auditing: provides an
independent and objective opinion to
an organisation’s management as to
whether its risks are being managed
to acceptable levels.
management
5
Objectives
1
The
audit
4
An
internal control
is a process which
manages a risk
A
risk
is a set of
circumstances
that hinder the
achievement of
objectives
©David M Griffiths
3
2
Significant risks generate
the audit plan
www.internalaudit.biz