Assess risk level

Risks should be prioritised according to their level, which is obtained by assessing the likelihood of the event occurring and the impact of that event. Then, the residual level should be determined by considering the management response to the risk.

Performance audit

Planning

Ref: 34.230

[section separator="true"]

[section-item 9]

[row]

[column 12]

[toc-this]

Instructions

Assessing the risk level

The audit team should only assess those risks identified as

[link title="key" link="%2Faware%2FPA%2FPages%2FPlanning%2FRisk-identification.aspx%23Selectrisks" /]

. The audit team should not aim for unrealistic levels of accuracy. The accuracy of the risk analysis will depend on the quality of the information available. Evidence should be used when it is available. Nevertheless, the auditor has also to rely on common sense and sound professional judgement, based on the knowledge acquired and on experience. It is sufficient to determine the level – high, medium, low - of the key parameters:

[label stroke="true"]Risk formulation = likelihood of occurrence x impact of the event[/label]

When deciding on the likelihood of occurrence, the fundamental difficulties in risk assessment are that statistical information is not available and rare failures are hard to estimate. When estimating the likelihood of an event, the audit team will inevitably work on assumptions. These assumptions should be reasonable and should be documented.
To determine the impact (level of seriousness), the audit team should investigate how vulnerable the organisation is to the threats posed, and determine what is the likely consequences of the risks on the organisation and/or the achievement of relevant objectives, should the risk materialise. The analysis of the consequences of risk should not be restricted to the direct effects only but should extend as far as possible.

The time spent on quantifying risks should relate to the significance they are likely to play in formulating the audit objectives. The overall evaluation is the result of the combination of both elements using the risk matrix:

Risk response

For those risks assessed as Medium and High, the audit team should examine management response in place. This examination allows assessing how well an entity is managing major risks rather than simply focusing on areas of suspected weakness. Risk response and control activities are the actions, policies and/or procedures that help to ensure that management directives are carried out, and that necessary actions are taken to address and reduce the risks to the achievement of the organisation's objectives. Several strategies can be adopted to deal with risk. Risk can be avoided, reduced, tolerated, mitigated, eliminated or transferred. Not all risks can or should be avoided; reducing all risk to 'zero' is usually not cost-effective for the organisation. To identify the actions, controls and/or procedures that have been taken to counter the main risks identified, the auditor can start by taking the List of Expected Key Controls set up in Step 1 of the risk assessment and comparing these to the controls that management asserts to be in existence. It is also necessary to ascertain what controls are actually in operation, and establish the extent of their limitations. Controls can also be performed externally by, e.g., national certifying bodies or internally by the Internal Audit Service or a specific unit, e.g. a reconciliation unit. Examples of controls may include:

Internal control systems as a whole and more specifically,
Financial controls
Segregation of duties, access controls, delegation of authorities
Policies and procedures for monitoring and supervision
Audit and evaluations
Reporting on performance and results
Guidelines, procedures, manuals, standard forms etc.
Training / information campaigns

Assessing residual risk

The final assessment of the risk level, or residual risk level, takes into account the management response in place to adjust, i.e., increase or decrease the initial risk level, if appropriate. Reducing the risk level is a critical decision that should be taken after careful consideration, based on the experience and sound judgement of the auditor.

Involving the auditee

At this stage it is advisable to discuss and confirm the programme logic model, the flowchart and the risk analysis, with the auditee.

Resources

[icons-list icon-size="2" separator="line" icon-vertical-alignment="middle" vertical-alignment="middle"]

[icon-list-item title="Risk%20assessment%20template" description="The%20audit%20team%20records%20the%20assessment%20of%20the%20risk%20level%20on%20Sheet%20'St3-%20Risk%20Analysis'%20of%20the%20template.%20The%20second%20and%20last%20column%20are%20are%20manually%20copied%20to%20the%20next%20sheet%20'St4-%20PAQS%20table'." link="%2Faware%2FDocuments%2FRisk-assessment-template.xlsx" icon="file-excel-o" /]

[/icons-list]

References

Enterprise Risk Management - Integrated Framework,
[link new-window title="The%20Committee%20of%20Sponsoring%20Organizations%20of%20the%20Treadway%20Commission%20(COSO)%2C%202004" link="https%3A%2F%2Fwww.coso.org%2FPages%2Fdefault.aspx" icon="external-link" /]
.

[/toc-this]

[/column]

[/row]

[/section-item]

[section-item 3]

[row]

[column 12]

[toc fixed="true" selectors="h2%2Ch3" class="basic-toc" /]

[/column]

[/row]

[/section-item]

[/section]

Last Modified: 13/09/2021 16:13 Tags:

Assess risk level // <![CDATA[ _spBodyOnLoadFunctionNames.push("setupPageDescriptionCallout"); // ]]>

Assess risk level

Instructions

Assessing the risk level

Risk response

Assessing residual risk

Involving the auditee

Resources

References

Assess risk level