What is the first step in risk-based audit planning?

Índice Show

A typical audit with no consideration of risk
What a risk-based internal audit involves
Steps for conducting a risk-based internal audit
Step 1: Assessing risk maturity
Step 2: Periodic audit planning
Step 3: Individual audit assignments
Risk and audit management software from isoTracker
isoTracker’s QMS software: affordable and modular
1) Define your goals
2) Organize your data
3) Get agile

Over recent years, a move to “risk-based thinking” has dominated quality standards like ISO 9001: 2015. It now informs the approach of quality professionals.

Unfortunately, the concept isn’t always remembered – or properly understood – when it comes to internal audits. As in the past, the focus is still on “ticking off boxes”.

Here, we look at how risk-based thinking should affect internal auditing processes.

A typical audit with no consideration of risk

In a traditional internal audit the focus is on compliance with external requirements with little or no consideration of risk.

The audit schedule is based on the audit cycle. It focuses on deficiencies in controls and cases of non-compliance with policies and procedures.

Internal audit resources are spread over all business activities and business risks are not mapped.

Frequently, there’s disagreement with the business management over the action plans, which leads to delays in implementation.

This can lead to audit results that mean very little, with boxes ticked to ensure a company meets the clauses of the ISO 9001 standard, but a failure to truly address quality issues.

For example, a company proudly hangs its ISO certificate in its reception area, yet fails to deal with repeated complaints from a customer who is experiencing ongoing quality issues.

What a risk-based internal audit involves

A risk-based internal audit (RBIA) links internal auditing to an organization’s overall risk framework, putting risk at its center.

A RBIA is driven by the most recent risk assessments with management’s highest priority risks being addressed first.

The focus shifts from deficiencies in all internal controls and cases of non-compliance with an organization’s policies and procedures to the way in which risks specifically are controlled.

A RBIA brings an audit in line with real business goals and priorities and the risks associated with those goals. Internal auditors manage the internal control activities and help an organization develop its risk management processes by defining its risk landscape.

The benefits of a RBIA include:

easier for an organization to adapt to changing conditions
better understanding and management of risks
identification of risks and placement of internal controls to ensure best performance
easier to understand risks and their effects.

Steps for conducting a risk-based internal audit

To conduct an effective RBIA, internal auditors must have a deep understanding of an organization’s business, its strategies, goals and objectives, so that the audit can focus on the organization’s most critical risk areas. Management must work closely with auditors to align business strategy and risks.

An organization’s directors must ensure the risk management framework includes:

identification and evaluation of risks that threaten the organization’s goals
an approved risk appetite so that risks can be easily identified as being above or below it
development of an internal control system to reduce threats to below the risk appetite
risks must be recorded, assessed and classified in order of threat
defined responsibility for providing assurance on risk management framework.

A RBIA is usually implemented in three steps.

Step 1: Assessing risk maturity

An overview is obtained regarding the assessment, management and risk monitoring. This shows the reliability of the risk for audit planning purposes.

Step 2: Periodic audit planning

An audit is planned for a specific period where all areas requiring objective assurance are identified and prioritized. The risk management processes, the management of key risks and the recording and reporting of risks are included.

Step 3: Individual audit assignments

Individual risk-based assignments are executed that provide assurance on part of the risk management framework. For example, on the mitigation of individual or groups of risks.

Risk and audit management software from isoTracker

isoTracker can help your organization perform a risk-based internal audit. We can help with both risk assessment and the internal auditing process.

Our software dramatically simplifies risk management. It provides an integrated, centralized, cloud-based system for identifying, assessing, monitoring, and mitigating risks. It uses automated notifications and workflows to assign and track risk mitigation tasks, and benefit from up-to-date risk analytics.

Our cloud-based audit management software simplifies compliance and helps companies conduct and pass audits, and drives improvements.

It has built-in features for ensuring that audit and compliance issues are reliably resolved.

Our risk and audit management modules can integrate seamlessly as part of a full QMS or stand alone and be used independently.

isoTracker’s QMS software: affordable and modular

isoTracker offers modular, subscription-based quality management software that’s secure, cloud-based and affordable. As well as audit and risk management software to help with a risk-based internal audit, we offer document management, complaints management, and training modules, with built-in CAPA capabilities.

Digital quality management is one, straightforward way for small to medium manufacturing businesses to start realizing value from Industry 4.0 – and with isoTracker’s QMS, it’s easy and cost-effective to implement.

Get a free trial now

Public sector organizations face a variety of risks, ranging from cyber threats to budget constraints to compliance concerns. While internal audit teams in the government sector might not be responsible for solving all those risks, they need to make sure that they are following through with relevant risk management protocols.

Therefore, it is essential that internal audit teams are conducting internal audit risk assessments to figure out what these risks look like.

“Risk-based auditing ensures that the internal audit activity is focusing its efforts on providing assurance and advisory services related to the organization’s top risks… This requires internal auditors to have a working knowledge of basic concepts, frameworks, tools, and techniques related to risk and risk management,” explains the Institute of Internal Auditors (IIA).

In this article, we’ll examine five tips to help public sector internal auditors build better risk-based audit plans. These include:

1) Define your goals

Before you get too bogged down in the specifics of running an internal audit risk assessment, take a step back and consider what you’re trying to accomplish. Doing so includes finding internal alignment within your audit team and with other stakeholders.

As Baker Tilly advises, internal audit teams “should meet with the various stakeholder groups – management, the audit committee, and the governing body – to explain the process, set expectations for the results and listen to any desired outcomes, as a means of adapting the approach or identifying other activities where internal audit can add value.”

2) Organize your data

Conducting an internal audit risk assessment also requires strong data practices. But before you can get to a place where you are using data analytics to identify key risks, public sector organizations often need to organize their data first.

Information might be held in a variety of systems that makes analysis inefficient, if not ineffective. Tools like TeamMate+ use a data exchange API framework to pull together data from different sources, such as governance, risk, and compliance (GRC) systems and enterprise resource planning (ERP) tools, giving you a complete picture of what’s happening within your organization.

3) Get agile

If you go through an entire risk-based audit without getting any feedback along the way, then it’s easy to get off track. For one, risks might have changed from the time the audit started to when it eventually wraps up. And when you present to stakeholder leaders at the end of the risk assessment, it can be tough to then incorporate their feedback into your internal controls and assurance processes.

Engaging in agile auditing can help. By breaking an internal audit risk assessment down into more manageable chunks — where different risk areas go from the planning to presentation stages in short sprints — public sector internal auditors may have an easier time adapting to change and incorporating feedback.

(1) Most important step in a risk analysis is to identify:A. competitors.B. controls.C. vulnerabilities.

D. liabilities.

Answer: C. vulnerabilitiesExplanation: If vulnerabilities are not properly identified, controls and audit planning may not be

relevant. Vulnerabilities are a key element in the conduct of a risk analysis

(2) In a risk-based audit planning, an IS auditor's first step is to identify:A. responsibilities of stakeholders.B. high-risk areas within the organization.C. cost center.D. profit center.

Answer: B. high-risk areas within the organization.Explanation: The first and most critical step in the process is to identify high-risk areas within the

organization. Once high-risk areas have been identified, audit planning to be done accordingly.

(3) When developing a risk-based audit strategy, an IS auditor should conduct a risk assessment toensure that:A. segregation of duties to mitigate risks is in place.B. all the relevant vulnerabilities and threats are identified.C. regularity compliance is adhered to.D. business is profitable.

Answer: B. all the relevant vulnerabilities and threats are identified.Explanation: In developing a risk-based audit strategy, it is critical that the risks and vulnerabilitiesbe understood. This will determine the areas to be audited and the extent of coverage.

(4) IS Auditor identified certain threats and vulnerabilities in a business process. Next, an IS auditor should:A. identify stakeholder for that business process.B. identifies information assets and the underlying systems.C. discloses the threats and impacts to management.D. identifies and evaluates the existing controls.

Answer: D. identifies and evaluates the existing controls.Explanation: Before reaching to any conclusion, IS Auditor should evaluate existing controls and itseffectiveness. Upon completion of an audit an IS auditor should describe and discuss with

management the threats and potential impacts on the assets.

(5) Major advantage of risk-based approach for audit planning is:A. Audit planning can be communicated to client in advance.B. Audit activity can be completed within allotted budget.C. Use of latest technology for audit activities.D. Appropriate utilization of resources for high risk areas.

Answer: D. Appropriate utilization of resources for high risk areas.Explanation: The risk-based approach is designed to ensure audit time is spent on the areas ofhighest risk. The development of an audit schedule is not addressed by a risk-based approach. Auditschedules may be prepared months in advance using various scheduling methods. A risk approachdoes not have a direct correlation to the audit staff meeting time budgets on a particular audit, nor

does it necessarily mean a wider variety of audits will be performed in a given year.

(6) While determining the appropriate level of protection for an information asset an IS auditorshould primarily focus on:A. Criticality of information asset.B. Cost of information asset.C. Owner of information asset.D. Result of vulnerability assessment.

Answer: A. Criticality of information asset. Explanation: The appropriate level of protection for an asset is determined based on the criticalityof the assets. Other factors are not that relevant as compared to sensitivity of information asset to

business.

(7) The decisions and actions of an IS auditor are MOST likely to affect which of the followingrisks?A. InherentB. DetectionC. ControlD. Business

Answer: B. DetectionExplanation: Detection risks are directly affected by the auditor's selection of audit procedures andtechniques. Inherent risks usually are not affected by the IS auditor. Control risks are controlled by

the actions of the company's management. Business risks are not affected by the IS auditor.

(8) The risk of an IS auditor certifying existence of proper system and procedures without using aninadequate test procedure is an example of:A. inherent risk.B. control risk.C. detection risk.D. audit risk.

Answer: C. detection risk.Explanation: This is an example of detection risk. Detection risk is the risk that the auditors fail to

detect a material misstatement in the financial statements

(9) Overall business risk for a particular threat can be expressed as:A. a product of the probability and impact.B. probability of occurrence.C. magnitude of impact.D. assumption of the risk assessment team.

Answer: A. a product of the probability and impact.Explanation: Choice A takes into consideration the likelihood and magnitude of the impact andprovides the best measure of the risk to an asset. Choice B provides only the likelihood ofoccurrence. Similarly, choice C considers only the magnitude of the damage and not the possibilityof a threat exploiting vulnerability. Choice D defines the risk on an arbitrary basis and is not suitable

for a scientific risk management process.

(10) An IS auditor is evaluating management's risk assessment of information systems. The ISauditor should FIRST review:A. the controls already in place.B. the effectiveness of the controls in place.C. the mechanism for monitoring the risks related to the assets.D. the threats/vulnerabilities affecting the assets.

Answer: D. the threats/vulnerabilities affecting the assets. Explanation: One of the key factors to be considered while assessing the risks related to the use ofvarious information systems is the threats and vulnerabilities affecting the assets. Similarly, theeffectiveness of the controls should be considered during the risk mitigation stage and not duringthe risk assessment phase. A mechanism to continuously monitor the risks related to assets should

be put in place during the risk monitoring function that follows the risk assessment phase.

(11) An IS Auditor is reviewing data center security review. Which of the following steps would anIS auditor normally perform FIRST:A. Evaluate physical access control.B. Determine the vulnerabilities/threats to the data center site.C. Review screening process for hiring security staffD.Evaluate logical access control.

Answer: B. Determine the risks/threats to the data center site.Explanation: During planning, the IS auditor should get an overview of the functions being auditedand evaluate the audit and business risks. Choices A and D are part of the audit fieldwork process

that occurs subsequent to this planning and preparation. Choice C is not part of a security review.

(12) Risk assessment approach is more suitable when determining the appropriate level ofprotection for an information asset because it ensures:A. all information assets are protected.B. a basic level of protection is applied regardless of asset value.C. appropriate levels of protection are applied to information assets.D. only most sensitive information assets are protected.

Answer: C. appropriate levels of protection are applied to information assets.Explanation:On the basis of risk assessment, assets are classified according to its criticality. Then appropriatelevel of security is provided to data as per classification

(13) In a risk-based audit approach, an IS auditor should FIRST complete a (n):A. inherent risk assessment.B. control risk assessment.C. test of control assessment.D. substantive test assessment.

Answer: A. inherent risk assessment.Explanation: The first step in a risk-based audit approach is to gather information about thebusiness and industry to evaluate the inherent risks. After completing the assessment of theinherent risks, the next step is to complete an assessment of the internal control structure. Thecontrols are then tested and, on the basis of the test results, substantive tests are carried out andassessed.

(14) In planning an audit, the MOST critical step is the identification of the:A. areas of high risk.B. skill sets of the audit staff.C. test steps in the audit.

D. time allotted for the audit.

Answer: A. areas of high risk.Explanation: When designing an audit plan, it is important to identify the areas of highest risk todetermine the areas to be audited. The skill sets of the audit staff should have been consideredbefore deciding and selecting the audit. Test steps for the audit are not as critical as identifying theareas of risk, and the time allotted for an audit is determined by the areas to be audited, which are

primarily selected based on the identification of risks.

(15) Risk assessment process is:A. subjective.B. objective.C. mathematical.D. statistical.

Answer: A. subjective.Explanation: Risk assessment is based on perception of risk officer. There is no definedmathematical or statistical formula for risk assessment. All risk assessment methodologies rely onsubjective judgments at some point in the process (e.g., for assigning weightings to the various

parameters).

(16) The result of risk management process is used for:A. forecasting profitB. post implementation review.C. designing controlsD. user acceptance testing.

Answer: C. designing controlsExplanation:The ultimate objective of risk management process is to ensure identified risks are managed bydesigning various controls. The risk management process is about making specific, security-relateddecisions, such as the level of acceptable risk. Choices A, B and D are not ultimate goals of the riskmanagement process

(17) Managing the risk up to acceptable level is the responsibility of:A. risk management team.B. senior business management.C. the chief information officer.D. the chief security officer.

Answer: B. senior business management.Explanation:Senior management cannot delegate their accountability for management of risk. They have theultimate or final responsibility for the effective and efficient operation of the organization. Choices

A, C and D should act as advisers to senior management in determining an acceptable risk level.

(18) Evaluation of IT risks can be done by: A. finding threats/vulnerabilities associated with current IT assets.B. Trend analysis on the basis of past year losses.C. industry benchmark.D. reviewing IT control weaknesses identified in audit reports.

Answer: A. finding threats/vulnerabilities associated with current IT assets.Explanation: To assess IT risks, threats and vulnerabilities need to be evaluated using qualitative orquantitative risk assessment approaches. Choices B, C and D are potentially useful inputs to the risk

assessment process, but by themselves not sufficient.

(19) An IS auditor is reviewing payroll application. He identified some vulnerability in the system. What would be the next task?A. Report the vulnerabilities to the management immediately.B. Examine application development process.C. Identify threats and likelihood of occurrence.D. Recommend for new application.

Answer: C. Identify threats and likelihood of occurrence.Explanation: The IS auditor must identify the assets, look for vulnerabilities, and then identify the

threats and the likelihood of occurrence.

(20) Absence of proper security measures represents a(n):A. threat.B. asset.C. impact.D. vulnerability.

Answer: D. vulnerability.Explanation:Vulnerability is a weakness or gap in our protection efforts. Vulnerability can be in form of weakcoding, missing anti-virus, weak access control and other related factors. Vulnerabilities can becontrolled by us.A threat is what we’re trying to protect against. Our enemy could be Earthquake, Fire, Hackers,Malware, System Failure, Criminals and many other unknown forces. Threats are not in ourcontrol.Lack of adequate security functionality in this context is vulnerability.

(21) IS Auditor is developing a risk management program, the FIRST activity to be performed isa(n):A. vulnerability assessment.B. evaluation of control.C. identification of assets.D. gap analysis.

Answer: C. identification of assetsExplanation: Identification of the assets to be protected is the first step in the development of a riskmanagement program. CISA aspirants should know following steps of risk assessment.• First step is to identify the assets.• Second step is to identify relevant risk (vulnerability/threat)• Third step is to do impact analysis• Fourth step is to prioritize the risk on the basis of impact• Fifth step is to evaluate controls.

• Sixth step is to apply appropriate controls

(22) Benefit of development of organizational policies by bottom-up approach is that they:A. covers whole organization.B. is derived as a result of a risk assessment.C. will be in line with overall corporate policy.D. ensures consistency across the organization.

Answer: B. is derived as a result of a risk assessment.Explanation:A bottom-up approach begins by defining operational-level requirements and policies, which arederived and implemented as the result of risk assessments. Enterprise-level policies aresubsequently developed based on a synthesis of existing operational policies. Choices A, C and Dare advantages of a top-down approach for developing organizational policies. This approachensures that the policies will not be in conflict with overall corporate policy and ensure consistencyacross the organization.

(23)Risk can be mitigated by:A. Implementing controlsB. InsuranceC. Audit and certificationD. Contracts and service level agreements (SLAs)

Answer: A. Security and control practicesExplanation:Risks are mitigated by implementing appropriate security and control practices. Insurance is amechanism for transferring risk. Audit and certification are mechanisms of risk assurance, andcontracts and SLAs are mechanisms of risk allocation

(24) Most important factor while evaluating controls is to ensure that the controls:A. addresses the riskB. does not reduce productivity.C. is less costly than risk.D. is automotive.

Answer: A. addresses the riskExplanation:Though all of the above factors are important, it is essential that control should be able to addressthe risk. When designing controls, it is necessary to consider all the above aspects. In an ideal

situation, controls that address all these aspects would be the best controls.

(25) The susceptibility of a business or process to make an error that is material in nature,assuming there were no internal controls.A. Inherent riskB. Control riskC. Detection risk

D. Correction risk

Answer: A. Inherent riskExplanation:Inherent risk means the risk that an activity would pose if no controls or other mitigating factors

were in place (the gross risk or risk before controls).

(26) The risk that the controls put in place will not prevent, correct, or detect errors on a timely basis.A. Inherent riskB. Control riskC. Detection riskD. Correction risk

Answer: B. Control riskExplanation:Control risk means the risk that a misstatement could occur but may not be detected and corrected

or prevented by entity's internal control mechanism.

(27) Which of the following factors an IS auditor should primarily consider when determining theacceptable level of risk:A. Risk acceptance is the responsibility of senior management.B. All risks do not need to be eliminated for a business to be profitable.C. Risks must be identified and documented in order to perform proper analysis on them.D. Line management should be involved in the risk analysis because management sees risks dailythat others would not recognize.

Answer: C. Risks must be identified and documented in order to perform proper analysis on them.Explanation:Though all factors are relevant, primarily consideration should be documentation of identified risk.In order to manage and control a risk, it first must be recognized as a risk. Only after

documentation, other factors to be considered