A SOLID UNDERSTANDING OF RISK

The overarching objective of an internal audit activity is to add value by helping the organization achieve its objectives. The best way to do this is to deliver risk-based services aimed at evaluating how well key risks affecting those objectives are being managed and providing advice to improve risk management activities. Ensuring that the audit approach is based on a firm foundation, with a solid understanding of risk, is a good place to start. A sound risk definition is the cornerstone of a risk-based audit approach. The definition must be both rigorous and unambiguous, and generally accepted both within internal audit and throughout the organization. Cost-effective delivery of risk-based audit services depends on careful planning. A solid understanding of risk can aid auditors in formulating sound judgments and making informed planning decisions. Although risk-based auditing is not new, there is still room for improvement. Carefully thinking about risk can improve internal auditors' annual planning decisions about allocating audit resources, resulting in more effective and efficient auditing.