An important in the internal auditor’s toolbox, risk-based auditing effectively serves the three primary roles of internal auditing — to provide feedback on the adequacy of internal control, to provide a source of information for monitoring risk, and to provide identification and communication of best practices among industries and operating lines of business.
The focus of the risk-based audit — to validate that the internal control environment is functioning as planned, that assets are adequately safeguarded, and that the organization is operating in conformance with established policies — is the same as the focus of a traditional audit. Both processes include communicating the results of the control assessment to executive management and the audit committee. The difference between the two processes is the focus on the scope of the audit procedures designed to achieve these goals, which is set through the risk-assessment and audit-planning processes.
The risk-based approach includes formal annual planning, updating the plan before audit segments begin, and periodic feedback from management and the audit committee regarding report content expectations. The audit scope is adjusted based on all of these factors and gives the internal auditor a keen ability to understand and react quickly to management and audit committee concerns regarding risk and audit coverage. A seven-step process outlining an effective risk-based approach can easily be adapted in all internal audit environments

THE SEVEN STEP PROCESS

Step One: Understanding the Business Environment
The key to effective risk-based auditing is for the internal auditor to begin the planning process with a thorough understanding of the business process for the area under review. In combination with feedback from management and the audit committee, business objectives are reviewed, specific risks that could cause management not to meet those business objectives are identified, and controls established by management to mitigate these risks are evaluated.

Step Two: Preliminary Risk Assessment
The purpose of the preliminary risk assessment is to determine the level of risk and adequacy of controls in the various functional processes of a business unit. The assessment focuses on the business profile, management structure, organizational changes, and specific concerns of management and the audit committee to determine the areas of greatest risk. It also serves to aid the internal auditor in evaluating the control design to determine the desired audit scope.

Step Three: Develop a Three-year Audit Plan
Based on the preliminary risk assessment that places the auditable business processes within a risk matrix based on low to high risk, a three-year audit plan is established. With certain adjustments based on management and audit committee input or regulatory requirements, low- risk areas would be audited every three years, moderate-risk areas audited every other year, and high-risk areas audited every year.

Step Four: Complete the Secondary Risk Assessment
In this stage, which is performed during the scheduled audit, the internal auditor determines the effectiveness of the control design. Through in-depth interviews, walk-throughs, and other observations the internal auditor determines whether or not the controls established by management are in fact operating as designed.
Step Five: Execution of the Internal Audit Program
After making adjustments to the audit scope based on the results of the secondary risk assessment, the audit plan is finalized and audit fieldwork can begin. A standard audit program guides the audit process and determines which audit procedures should be performed based on the secondary risk assessment rating.

Step Six: Conduct a Formal Exit Meeting
A formal exit meeting should be conducted with both operating and senior management prior to leaving the field to present issues noted during the audit, as well as best practice suggestions for improving controls, efficiency, and operational performance. Minor exceptions or findings can be discussed verbally, and may not be included in the audit report.

Step Seven: Reporting and Communication
After the exit meeting, a report draft is issued to operating management to solicit corrective action plans. The draft report should include findings and recommendations ranked as high, moderate, or low risk. High risk indicates management should immediately remedy the situation to prevent significant risk of loss; moderate risk indicates that timely remedy by management is suggested; and low risk indicates that there does not appear to be an immediate risk but improvements are still possible.