Overview
Risk-based auditing (RBA) is an approach to auditing in
which audit resources, procedures, and attention are directed primarily toward
areas that present the greatest risks to an organization's ability to achieve
its objectives.
Unlike a traditional audit approach that may give similar attention to
different transactions or departments, risk-based auditing begins by asking:
What could go wrong, how significant would the consequences be, and
how effectively is management controlling that risk?
The auditor then designs audit procedures around the identified risks.
Risk-based auditing has become an important component of modern internal
auditing because organizations operate in increasingly complex environments
characterized by technological change, cybersecurity threats, regulatory requirements,
financial pressures, fraud risks, globalization, and changing stakeholder
expectations.
The approach therefore shifts the focus of auditing from simply checking
transactions to understanding risks, controls, governance, and
organizational objectives.
Target
Participants
- Internal auditors
- External auditors
- Accountants and finance officers
- Risk management officers
- Compliance officers
- Internal control officers
- Managers and supervisors
- Audit committee members
- Government and public-sector officers
- NGO and project finance officers
FUNDAMENTALS OF RISK-BASED AUDITING
Module
1: Introduction to Risk-Based Auditing
- Meaning and concept of risk-based auditing
- Evolution from traditional auditing to risk-based
auditing
- Objectives and importance of risk-based auditing
- Risk-based auditing versus traditional auditing
- Benefits of risk-based auditing
- Role of the internal auditor
- Relationship between auditing, risk management and
internal controls
Module
2: Understanding Organizational Risk
- Definition of risk
- Risk and uncertainty
- Sources of organizational risk
- Strategic risks
- Operational risks
- Financial risks
- Compliance and regulatory risks
- Fraud risks
- Information technology and cybersecurity risks
- Reputational risks
- Project and investment risks
Module
3: Risk Management Framework
- Risk management principles
- Risk identification
- Risk analysis
- Risk evaluation
- Risk treatment
- Risk monitoring
- Risk reporting
- Risk appetite and risk tolerance
- Risk registers
- Key Risk Indicators (KRIs)
RISK ASSESSMENT
AND AUDIT PLANNING
Module
4: Risk Assessment Techniques
- Purpose of risk assessment
- Likelihood and impact assessment
- Qualitative risk assessment
- Quantitative risk assessment
- Inherent risk
- Control risk
- Residual risk
- Risk scoring
- Risk ranking and prioritization
- Risk heat maps
Module
5: Internal Controls and Risk Management
- Meaning and objectives of internal controls
- Preventive controls
- Detective controls
- Corrective controls
- Manual and automated controls
- Segregation of duties
- Authorization controls
- Reconciliation controls
- Physical controls
- IT controls
- Control design versus operating effectiveness
- Identifying control gaps
Module
6: Risk-Based Internal Audit Planning
- Audit universe
- Developing a risk-based audit universe
- Linking organizational objectives to risks
- Risk-based annual audit planning
- Audit prioritization
- Audit frequency
- Determining audit scope
- Allocating audit resources
- Developing audit objectives
- Preparing risk-based audit programs
- Coordination with management and the audit committee
EXECUTING, REPORTING AND MONITORING RISK-BASED AUDITS
Module
7: Conducting a Risk-Based Audit
- Audit engagement planning
- Preliminary risk assessment
- Understanding the audited process
- Process walkthroughs
- Identifying key controls
- Testing controls
- Substantive testing
- Audit sampling
- Analytical procedures
- Interviews and observations
- Gathering sufficient and appropriate audit evidence
Module
8: Risk-Based Audit Evidence and Documentation
- Types of audit evidence
- Reliability of audit evidence
- Audit working papers
- Audit trails
- Documentation standards
- Evidence evaluation
- Sampling documentation
- Control testing documentation
- Linking risks, controls, tests and findings
Module
9: Audit Findings and Risk-Based Reporting
- Identifying audit findings
- Condition
- Criteria
- Cause
- Effect
- Risk implications
- Root-cause analysis
- Risk-rating audit findings
- High-, medium- and low-risk findings
- Developing practical recommendations
- Management responses
- Preparing the internal audit report
- Communicating significant risks to management and the
audit committee
Module
10: Audit Follow-Up and Continuous Monitoring
- Importance of audit follow-up
- Tracking corrective actions
- Management action plans
- Monitoring implementation
- Escalating overdue high-risk findings
- Repeat audit findings
- Continuous auditing
- Continuous monitoring
- Using data analytics for risk monitoring