An Introduction to Risk Based Auditing

Risk based auditing is the working method of choice for most audit teams. This course introduces auditors to the fundamental concepts that drive an integrated risk based audit process.

Suitability and duration

Suitability: Beginner - Intermediate

Duration: 2 days

Who should attend

Those familiar with audit and basic risk management concepts that want to explore a holistic way of embedding risk into their Internal Audit protocol.
Practical exercises will span important elements of this intensive training course allowing delegates to learn by example.

Benefits

Skills

After completion of this course, you will be able to:

• Use risk to link the audit to organisational objectives
• Use risk based values to drive audits
• Apply risk to the process of control evaluation Draw on risk to structure audit reports

Support Materials

This course is accompanied by a manual that contains illustrations, explanations and reference materials to use after the event.

Programme

Risk based auditing and the internal auditor

• Internal Auditors and Risk Managers – the relationship
• The IIA UK and Ireland position statement on RBIA

Using risk to drive the audit

• Basic principles – planning from risk
• Defining risk-based scope and objectives Drafting a management letter for a risk-based audit

Performing a risk based audit – familiarisation

• Finding the significant processes that underpin the objective
• Examining and documenting the process flow

Performing a risk based audit – evaluation

• Predicting risk mitigating controls
• Revealing risk mitigating controls
• Control gap analysis
• Estimation of residual risk
• Relating residual risk to impairment of objectives

Performing a risk based audit – testing

• Defining testing strategies – reasonable assurance
• Compliance testing – weakness probing – substantive testing

Performing a risk based audit – notification

• Notifying risks during the audit
• Turnaround of notifications and quality assurance

Performing a risk based audit – draft reporting

• Meetings to clarify potential risks and risk appetite
• Structuring of draft reports and embedding risk concepts
• Management overviews, process diagrams, risk cause and effect models
• Displaying linkage of risk to objectives
• Risk management implications

Performing a risk based audit – final reporting

• Structuring of final reports – risk observation reporting
• Getting agreed prioritised action – escalating critical risk issues Follow up of risk-based audit reports