The Institute of Internal Auditors
The Institute of Internal Auditors
Pittsburgh Chapter
Perspectives on Risk Assessment
February 2013
Presenter
Name
Level Contact Information
Experience
Brian Portman
Senior Manager
brian.portman@ +1-412-644-0495
Brian is a Pittsburgh based Senior Manager within the Financial Services Office of Ernst & Young's Advisory practice. He has over fifteen years of management experience and nine years of experience in the financial services industry serving a variety of clients, primarily in the areas of internal audit, compliance and risk management. Brian leads several internal audit co-source and outsourcing arrangements, including all aspects of the internal audit framework - risk assessment, audit planning, audit execution, reporting, issue tracking and Audit Committee reporting. Prior to joining Ernst & Young, Brian worked as a Bank Examiner with the OCC, conducting safety and soundness, compliance and specialty examinations.
Page 1
Agenda
Introduction Great expectations Key risk assessment concepts Top down risk assessment Bottoms up risk assessment Engagement-level risk considerations Continuous monitoring risk considerations Risk assessment process Key takeaways Appendix: Sample matrices
Page 2
Great expectations
Great expectations
Institute of Internal Auditors
2010 ? Planning The chief audit executive must establish a risk-based plan to determine the priorities of the internal audit activity, consistent with the organization's goals Interpretation The chief audit executive is responsible for developing a risk-based plan. The chief audit executive takes into account the organization's risk management framework, including using risk appetite levels set by management for the different activities or parts of the organization. If a framework does not exist, the chief audit executive uses his/her own judgment of risks after consideration of input from senior management and the board. The chief audit executive must review and adjust the plan, as necessary, in response to changes in the organization's business, risks, operations, programs, systems, and controls.
2010.A1 ? The internal audit activity's plan of engagements must be based on a documented risk assessment, undertaken at least annually. The input of senior management and the board must be considered in this process.
2210 ? Engagement Objectives Objectives must be established for each engagement. 2210.A1 ? Internal auditors must conduct a preliminary assessment of the risks relevant to the activity under review. Engagement objectives must reflect the results of this assessment.
Page 4
Great expectations
Federal Reserve Board
Internal Audit Risk Assessment
Assessments typically analyze the risks inherent in a given business line or process, the mitigating controls processes, and the resulting residual risk exposure to the institution
Assessment should be well documented and dynamic, reflecting changes to the system of internal controls, infrastructure, work processes and new/changed business lines or laws and regulations.
Risk assessments should consider thematic control issues, risk tolerance, and governance within the institution
Assessments may be qualitative and quantitative and include factors such as impact/likelihood of an event occurring.
Should be formally documented and supported with written analysis of the risks.
Should include specific rationale for the overall auditable entity score
A high-level summary of risk assessment results should be provided to the audit committee and include the most significant risks facing the institution, as well as how those risks have been addressed in the audit plan
Page 5
Great expectations
Perspectives
"Risk assessment is a process by which an auditor identifies and evaluates the quantity of the organization's risks and the quality of its
controls over those risks " OCC
"The existence of risk is not the primary reason of concern, rather auditors must determine if the risks are warranted. Generally, risks are warranted if they are understandable, controllable, and within the institution's capacity to
withstand adverse performance" FFIEC
"Risk analysis is intended to provide auditors with a concise method of communicating and documenting judgments about the quantity of risk,
quality of risk management, and aggregate levels of risk." FFIEC
Page 6
Great expectations
Fundamentals
All risk-based audit programs should:
Identify all of an institution's businesses, product lines, services, and functions Identify the activities and compliance issues within those businesses, product lines,
services, and functions that should be audited Include profiles of significant business units, departments, and products that identify
business and control risks and document the structure of risk management and internal control systems. Use a measurement or scoring system to rank and evaluate business and control risks of significant business units, departments, and products Include board or audit committee approval of risk assessments or the aggregate result thereof and annual risk-based audit plans Implement the audit plan through planning, execution, reporting, and follow-up Have systems that monitor risk assessments regularly and update them at least annually for all significant business units, departments, and products
Page 7
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related download
- succession planning a step by step guide
- chapter 6 1 habitats niches and species interactions
- succession commack schools
- succession answer sheet anoka hennepin school
- succession changing forest habitats
- biodiversity succession and resources
- succession section 4 changing forest habitats
- b c a d pond b
- continuity of operations coop planning template and
- front matter 5th grade home
Related searches
- the importance of internal customers
- seton institute of reconstructive surgery
- michigan institute of real estate classes
- sports institute of tucson
- institute of physics iop
- institute of physics uk
- american institute of physics
- american institute of physics citation
- american institute of physics inc
- chicago institute of plastic surgery
- indian institute of public health
- nigerian institute of international affairs