Insights: Article

No Cookie Cutting- Best Practices for a Risk-Based Internal Audit Function

August 16, 2016

When it comes to an internal audit, one size does not fit all. Because you have different needs, policies, procedures, staffing, risks, risk appetites and other variables, your internal audit function should be as unique as your institution. In addition, your employees’ time is becoming more and more valuable, so your internal audit function should strive for more efficiency than ever before. A risk-based internal audit approach can give you both a unique and tailored approach to your internal audit function and increased efficiency.

Determine Your Risk Scores
A risk-based approach begins with the preparation of an annual risk assessment and internal audit plan. Through inquiries and observations, you assess risk across the general areas of the financial institution. Risks considered might include credit risk, liquidity risk, interest rate risk, legal risk and reputation risk. The goal of the risk assessment process is to assign a “risk score” to each general area of the institution, which is the basis for your annual internal audit plan. Areas that score higher in risk, such as loan administration and information technology, are tested more frequently by internal audit, perhaps on an annual basis. Those areas assigned lower risk scores, such as prepaid expenses or safe deposit boxes, are tested by internal audit less frequently, and may only be included in your internal audit plan on a tri-annual basis.

Tailor Your Approach
When you have your risk-based internal audit plan for the year defined, the internal auditor will then carry out the audits of the general areas of the institution according to the plan. It is important to incorporate a risk-based element when determining the internal audit procedures you will complete for a given area. High-risk areas require more controls and more internal audit testing to verify the controls exist and are operating effectively. Low-risk areas do not have as many internal controls in place; as a result, internal audit testing could be kept at a higher level. Audit programs should be tailored to your organization based on the area’s existing controls, the effectiveness of those controls, and previous regulatory exam or internal audit recommendations related to the particular area.

Risk-based Reporting
Once an audit of a given area is completed, a report should be submitted directly to the audit committee, board of directors, or supervisory committee detailing the findings, recommendations or observations. You can also incorporate a risk-based element into this reporting process. You can choose not to include all technical or isolated exceptions in your reports and report specific exceptions only to management. Try not to place too much emphasis on specific findings and exceptions in these written reports. Instead, address questions such as “What caused this exception?” or “What process needs to be enhanced so that this does not happen again?” This manner of reporting helps to ensure that the audit committee, board of directors, or supervisory committee understands the process improvements and the value that an internal audit department brings to the organization.

Latest Insights

July 19, 2018
Article
While it’s great to watch your team grow, hiring new employees can be a frustrating and grueling process.
July 19, 2018
Article
Often, human resources (HR) is over looked, but we’re here to tell you it’s an essential component of any organization and critically important to get right.
July 13, 2018
Article
Here are some idea for giving your new hire a smooth start into your business and alleviating stress for you.
July 13, 2018
Article
The impact of the recent SCOTUS Wayfair decision will continue to have a ripple effect on businesses and state sales tax compliance.
July 9, 2018
Article
The revenue cycle is a complex system and we have historically given much attention to the front-end and back-end while oftentimes leaving the middle functions of the cycle neglected.
July 3, 2018
Article
FASB Accounting Standards Codification Topic 606, Revenue from Contracts with Customers, provides a 5-step framework for determining revenue recognition.
July 2, 2018
Article
As part of the Tax Reform Act of 1986, the “Kiddie tax,” a taxing regime designed to make the transfer of income items by wealthy parents to lower tax paying children less attractive, was implemented.
July 2, 2018
Article
When it comes to your employees, you likely conducted interviews on them when you first hired them.
July 2, 2018
Article
Nearly ten years after the release of the initial exposure draft, FASB issued ASU 2016-02, Leases - The standard may have been issued, but the conversation about this re-write of legacy guidance has not slowed.