Risk assessment is a systematic technique used in evaluating risk inherent in a process, system or activity with a view to mitigating their impact. In an organization that have an entrenched enterprise risk management framework or process, the responsibilities for risk identification, assessment, treatment, mitigation and monitoring are well defined. As such it is the duty of the audit team to obtain the risk assessment result of the area to be audited to gain good understand of the risk inherent in the process areas, which will aid in the channeling of audit effort and resources. Result of risk identification and assessment are documented in the risk register of the organization.
Having a prior understanding of the risks inherent in a given audit area, controls implemented to mitigate them and residual risk in place after control implementation helps the internal audit function in conducting a risk-based audit. In documenting the risk, their severity/impact would have been determined in terms of assigning a weighted score (ranking or rating) to them in line with the risk management framework adopted by the organization’s risk function if applicable. This will help the audit team in performing risk-based audit by determining areas to pay more attention to than the others due to their risk rating.
Internal audit responsibilities are usually made easier where an effective risk function is in place as all that is required is to obtain risk assessment results of the subject area to be audit from relevant stakeholders and use same in planning and execution of the audit. However, the opposite in the case for situations where there is non-existing or inadequate risk management function in place in the organization. The internal audit function may carry the risk management burden or suffer because its inadequacies. In which case, the audit function must ensure that they present their opinion on the effectiveness or otherwise of the risk management function to the board audit committee and executive management whose responsibility it is to ensure the establishment and entrenchment of risk management culture within an organization.