Risk Based Internal Auditing (RBIA)

• An introduction to Risk Based Internal Auditing
• Traditional Approach versus Risk Based internal approach
• Stages of Risk Based Internal Auditing
• Measuring the effectiveness of Risk Based Internal Auditing

• Rationale behind Risk Based Internal Auditing
• Internal Audit – Definitions, Objectives & Scope
• The “Expectations Gap”
• The RISK BASED Internal Audit
• Comparison to the traditional approach

• The meaning of risk
• The attributes of risk – Likelihood & Consequence
• The Risk Heat Map
• Audit risk
• Business risks – classification, internal & external, controllable & non-controllable
• The COSO risk management framework

• COSO — An Integrated Risk Management Framework
• The COSO ERM Framework
• COSO in Finer Detail
• Updates to COSO

• Risk capacity, risk appetite, risk response
• Inherent & residual risk
• Entity risk assessment & Business process risk assessment
• Significant risk
• Risk register

• ERM and the Board of Directors
• What is covered under ERM

• What is risk maturity
• Why it is important
• Risk maturity levels
• Scorecard for assessing risk maturity
• Analyzing the risk maturity results

• Audit is of management of risks and not of risk
• Key reporting areas in the management of risks
• Documenting Board assurance requirements and risk appetite
• Audit strategy & risk maturity
• Selecting individual risks to audit
• Frequency of coverage
• Including the Risks into an Audit Assignment
• Importance of selecting the right auditable unit

• Assessing risk maturity
• Preparing the audit plan
• Conducting the assurance audit
• Reporting to the appropriate level

• Risk assessment steps
• Risk assessment tools
• Risk identification
• Business Activities that are Sources of Risk
• Operational Risk and its categories
• Risk identification methods
• Industry risk models
• Choosing which methods to use
• Typical risk areas
• Risk estimation (Risk measurement/ Risk scoring)
• Risk evaluation
• Risk Heat map & Actions Needed
• Using risk scores

• Market survey
• Dependency modeling
• SWOT analyses
• Event tree analysis
• BPEST (Business, Political, Economical, Social & Technological)
• Fault tree analysis (Root Cause Analysis)
• FEMA (Failure Mode and Effect Analysis)

In this section the instructor will cover the complete Internal Audit Process through with the RBIA methodology is carried out in a consistent manner. This covers the need for the Internal Auditor to become acquainted with the business and the industry allowing him to assess the risk maturity which determines his/her ability to provide the PBIA assurance and to review the risk assessment done by management and the her/his conclusion whether this risk register may be relied upon.

The process covered includes;

• Strategic analysis
• Enterprise risk assessment
• Internal Audit Plan development
• What Risks to Audit – An Alternative Approach
• Internal Audit execution
• The Process Risk Matrix
• Reporting
• Issue Resolution tracking

The speaker will compare RBIA methodology to the regular audit methodology. These methodologies will be examine in terms of;

• Managing risk
• Setting responsibility for risk management, and
• Usefulness to the Board of Directors

The speaker will examine and discuss examples of the RBIA documentation form the case study including;

• Risk Register
• Audit Procedures and
• Transaction Files.