Risk Based Internal Auditing - The New Approach

Introduction

The Institute of Internal Auditors defines Internal auditing as an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes. (2013).

Problem Statement

If you entered the Internal Audit profession twenty or thirty years ago you would not recognize the above definition of internal auditing. The fact is that Internal Auditing has changed significantly over the last decade. Much of those changes have been driven by new regulation and regulatory demands, new technology, new professional standards, globalization  new ways of working especially the need for collaboration as well as a more proactive, dynamic and risk based approach to auditing. The fact is that many career auditors need to re-tool, re-think and re-train to carry out their new expanded responsibilities effectively.

Previous Options

In the old traditional, conventional approach to auditing. Internal auditing was a compliance based activity. The traditional internal auditor armed with his checklists, standard audit tests and annual audit plan felt capable of providing assurance to management that internal controls were working effectively and that all assets had been safe-guarded. With the role of the internal auditor being redefined in line with the introductory definition above, more is needed for the Internal auditor to be able to help his organisation accomplish its operational objectives while improving the effectiveness of of risk management, control, and governance processes, by his objective independent consulting activity.

Clement Ashley Consulting's Solution

Clement Ashley Consulting recommends a Risk Based Internal audit approach that has a business focus rather than an audit focus. The Risk based approach should have a process forcus rather than a transaction focus, it should focus on improvement of risk identification rather than compliance for compliance sake. The risk based approach to internal auditing should use open questioning techniques rather than the traditional closed questioning. The mindest of the risk based internal auditor should be one of change facilitation to improve performance rather than policy adherence.The risk based internal auditor should see himself as a consultant rather than a policeman, if he holds himself accountable for performance improvement results, he will be seen as adding value and not as a cost center  this in turn will enhance his ability to move into other management positions. The risk based internal auditor should be more interested in the future than the past and therefore be more proactive and less reactive. The risk based internal auditor should focus on solutions rather than problems and hence major on performance rather than conformance.

Benefit 1

A risk based audit approach maximizes the use of scarce internal audit resources.

Benefit 2

Using the risk based approach you will have the ability to identify new and emerging risks that can affect achievement of your organisations goals and objectives.

Benefit 3

A risk based approach will force a prior implementation of enterprise risk management, which will directly improve organisational performance.

Benefit 4

The risk based approach to internal audit has the benefit of not only highlighting risks that are not properly controlled but also those that are over-controlled and thereby consuming scare organisational resources.

Summary

As Mike Thomas CIA says 'the risk-based auditing approach encompasses the attributes of business knowledge, macro-risk assessment, strategic audit planning, and detailed risk assessment necessary to effectively and efficiently deploy audit resources. If performed correctly, this approach will allow the internal auditor to focus on the areas of risk proportionate to the potential exposure to the company. The cycle of continually assessing risk, efficiently planning audit activities, and effectively performing, delivering, and reporting audit activities can result in overall lower risk to the organization at reduced cost'.

Author

Ijeoma Rita Obu is the managing Consultant of Clement Ashley Consulting and can be reached at  robu@clementashleyconsulting.org

Managing Risks Growing Businesses Face

Introduction

Growth (top-line) and profitability (bottom-line) are two major indices that define how well organizations are doing in pursuit of their strategic objectives and short term goals.

Business organizations achieve growth through organic or inorganic channels. Growth occurs largely via the development of a new product, creation of a new business line, mergers and acquisitions, increase in market share and direct expansion into a new market. In pursuing any, a combination or all of the aforementioned growth strategies business organizations face several risks. Typically organizations are faced with Macro-economic risk, Credit risk, Market risk, Reputation risk, problems associated with access to credit, social acceptance/corporate social responsibility risk, technology risk, political risk, geopolitical risk, Economic shock, etc. Effective risk management enables business organizations to successfully exploit business opportunities and contain threats. It does this by providing insights and assurances required to take advantage of profitable ventures.

Problem Statement

The risk management framework and practices that exist in most business organizations are not adequate to enable them to navigate to safety in times of trouble. The risk management culture, the governance and organizational structure, the design of the risk management framework, processes, policies and procedures, risk management tools, sophistication of risk identification and measurement techniques and skills available are not fit for today’s purpose and tomorrows expectations. This is evidenced by the impact of the recent global financial crisis. Systemically exposed business organizations are even more exposed. Business organizations need to embrace best practices to better prepare them for the rainy day.

Previous Options

Current practice in most business organizations is that risks are managed in 'silos'. Risks are also not managed in the context of strategy and objectives. Risk Management is often times seen as totally alienated from performance management. This means that each business line, group or division in an organization manages its strategic, business and operational risks independently, if at all.. A case of ‘’to your tents O Israel’’. Risks are therefore not managed centrally or in alignment with strategic objectives and so, many of the strengths an organization can build and the benefits of a centralized risk management do not accrue to such organizations.

Our firm, Clement Ashley Consulting provides a risk management framework that takes an enterprise-wide view of risk as against silo management. This approach is called Enterprise-wide Risk Management (ERM). Enterprise Risk Management implies that risk management is done at the enterprise level instead of at the business line, business group or business division level and so is centrally coordinated. Strategic, Business and Operational risks are therefore managed not independently but holistically at the enterprise level. For financial institutions that are regulated Economic capital is a must as against a purely regulatory capital limit. Risk assessment is done from time to time so as to reflect market realities. There is also frequent review of the application and suitability of the established process in order to identify gaps for improvement.

Our approach begins with a review of existing risk management process and framework in the organization with a view to modify existing framework and practice based on regulatory requirements, market realities, business needs and best practices.

Benefit 1

Clement Ashley Consulting's Solution is in concert with what regulatory and supervisory authorities and rating agencies demand and so enables business organizations to comply with regulatory and supervisory requirements. The framework which Clement Ashley provides is also in line with best practices world over.

Benefit 2

Risk aggregation at the centre provides the required knowledge about how risks interact, about risk concentration and the actual overall risk faced by the organization giving that some risks offset others while some reinforce others such that risk responses and controls provided are better targeted and therefore more effective compared to what can be achieved under silo management.

Benefit 3

Risk management is centralized in Enterprise Risk Management and so duplication is avoided and therefore cost is minimized. Central coordination also ensures that there is consistency in the risk management approach.

Benefit 4

Any thing that can prevent an organisation from achieving its objectives and targets (be they financial targets or otherwise) is a risk that must be managed. Enterprise-wide risk management therefore assists organizations meet and exceed their performance objectives and stakeholders expectations.

Implementation

Implementation involves assessing the effectiveness of the designed risk management process and framework. It includes checking how well risk responses and controls, early warning indicators, etc are working. If responses and controls are not effective then a further risk identification is required to identify any risks left that made the responses and controls ineffective. Implementation may be iterative. It is a real time and real life activity. It does not include any form of simulation. Implementation stage provides the opportunity to adapt the designed framework to market realities and at the same time maintain the desired robustness that allows it provide adequate safeguard. Implementation is usually done in phases in line with the priorities of the client.

Summary

Till date many organizations manage risks in silos. Today’s realities and tomorrows expectations make silo management utterly inadequate. Risk aggregation at the enterprise level allows for better responses and more effective controls in the risk management process. Beyond meeting regulatory and rating agencies requirements and other stakeholders’ expectations, enterprise-wide risk management reduces to the barest minimum chances of unexpected losses. Removal of duplication and the cost reduction that go with it make enterprise risk management a more cost effective way of managing risks.