What is an internal audit risk assessment?

An internal audit risk assessment is the process of deciding which areas audit should examine and why. It ranks concerns so assurance work can focus where reliance is most uncertain.

What is the role of internal audit in risk management?

Internal audit's role in risk management is usually to provide independent assurance on whether governance and control processes are working as intended. It supports the organisation by reviewing the quality of the system. It does not own the underlying management decisions.

What does assurance mean in internal audit?

Assurance in internal audit means giving an independent view on whether processes or controls can be relied on. It is meant to build justified confidence. It is not a substitute for management judgement.

Should Internal Audit Assess Risk? | Sufficient Certainty

Q: Should internal audit assess risk?

In common practice, internal audit assesses risk to plan its work and understand where assurance is needed. That is different from taking over management's responsibility for the decisions being assessed.

John Fraser was asked recently whether internal audit should perform risk assessments, assuming an effective Enterprise Risk Management function exists. He argued that IA should provide assurance that ERM processes work effectively and validate that key controls assumed to be functioning actually operate as intended.

Internal audit risk assessment is the process of deciding where assurance work should focus and what areas warrant closer independent review.

The real question behind the question

Strip away the terminology and the core purpose becomes clearer. The ultimate purpose of whatever “ERM” and “IA” are meant to mean or be can surely only legitimately be that the organisation makes the best decisions it can.

Organisational success depends on consistent quality decision-making across all levels. In Deciding, Grant Purdy and I outline a Universal Decision-Making Method applicable to all decision-makers. We call them Deciders, because that is what they are.

Quality at the source, not inspection after the fact

There is a parallel to manufacturing quality control. Processes shifted decades ago from inspecting finished products to ensuring quality throughout production. The inspection model was expensive and caught problems too late. The quality-throughout model prevented them.

Organisational monitoring should follow the same logic. Focus on decision-making quality rather than post-decision evaluation. Monitor the assumptions that decisions rest on, not the outputs that have already happened. By the time you are inspecting the output, the decision is old and the damage, if any, is done. A risk assessment process built around the decision would catch the weak assumption before the commitment, not after the outcome.

What governance bodies should actually ask

Governance bodies should directly assess decision-making capability rather than outsourcing reassurance to hired auditors or risk managers. The IIA's Three Lines Model codified that outsourcing, assigning governance to a structure of lines rather than to the quality of thinking. The question is not “should internal audit perform a risk assessment?” The question is “are the people making decisions in this organisation doing it well, and how would we know?” That is the question the Universal Decision-Making Method is built to answer.

You could ask internal audit for another risk map and still miss the decision underneath.

Work through your decision

No sign-up. Just pick your decision and start.

Roger Estall was the co-author, with Grant Purdy, of Deciding (2020). He chaired the New Zealand Fire Service Commission and was a founding chairman of the NZ Society for Risk Management.