Risk-Based Auditing is common it and primarily focuses on audit risks, inherent risk, control risk, and detection risk in the activities or process system to ensure that internal audit activity is providing assurance and advisory service to the related organization’s risk area within the risk is being managed and the risk appetite level is defined. Risk-Based Auditing has become the basic concept of knowledge in modern internal auditing on how to make the organization better through good governance, risk management, and control.
The approach of using traditional auditing is mostly involved with the conduction of the test for providing the audit opinion on the fairness of the financial statements where the test on the internal control, internal policy, procedures, and so on is reviewed to assure that the figure in the financial statement is in conformity. Additionally, testing of account balance and walkthrough of business transactions posted in the accounting system is also made.
Similar to traditional auditing, the traditional internal auditing focuses on the testing of the control and operation unit process so as to check whether it is functional, or the processes are in place. Moreover, the traditional internal auditing involved in providing the internal audit recommendation on the control performed within the auditing period is mentioned in the policies and procedures.
With this Risk-Based Internal Auditing Approach, the internal auditor should be equipped with concepts of knowledge, frameworks tools, and an understanding of risk management.
Internal auditors should consider examining the control in the business process activities and by defining the descending order of the risk from higher risk to lowest risk. Regarding those defined risks, the internal auditors are also able to prepare the auditing schedule and team members.
Meanwhile, the internal auditors should have sufficient knowledge of the risk universal in their conduct of audits in many parts of a business and especially regarding risk-based internal auditing. With this respect to risk-based internal auditing, there are 4 points on which the internal auditors should focus on:
- To understand the business unit/department’s objectives.
- To understand all the aspects of business processes in the business unit/ department and map those objectives to risk areas.
- To prioritize the level of risk based on its impact (low, medium, and high) and consider to discuss with the management team in order to consider/eliminate the unnecessary controls with the low-rated risk with low impact.
- To mitigate the control, and test only the control with defined risk.
It is important for the internal auditors to manage their audit work effectively while the risk-based internal auditing is considered to include the internal audit universe that the auditable engagements are relevant to the organization and defined the key risk areas within the scope of the internal audit function to be reviewed and must provide the assurance for that.
In this modern internal auditing, a risk-based approach is very important for every internal auditor to adopt and implement in the organization. The risk-based internal auditing approach does not only helps the internal auditor work more effectively, economically, and align with the business unit needs but also allows the internal auditor to prioritize their audit work and resource allocation.