Insights: Article

No Cookie Cutting- Best Practices for a Risk-Based Internal Audit Function

August 16, 2016

When it comes to an internal audit, one size does not fit all. Because you have different needs, policies, procedures, staffing, risks, risk appetites and other variables, your internal audit function should be as unique as your institution. In addition, your employees’ time is becoming more and more valuable, so your internal audit function should strive for more efficiency than ever before. A risk-based internal audit approach can give you both a unique and tailored approach to your internal audit function and increased efficiency.

Determine Your Risk Scores
A risk-based approach begins with the preparation of an annual risk assessment and internal audit plan. Through inquiries and observations, you assess risk across the general areas of the financial institution. Risks considered might include credit risk, liquidity risk, interest rate risk, legal risk and reputation risk. The goal of the risk assessment process is to assign a “risk score” to each general area of the institution, which is the basis for your annual internal audit plan. Areas that score higher in risk, such as loan administration and information technology, are tested more frequently by internal audit, perhaps on an annual basis. Those areas assigned lower risk scores, such as prepaid expenses or safe deposit boxes, are tested by internal audit less frequently, and may only be included in your internal audit plan on a tri-annual basis.

Tailor Your Approach
When you have your risk-based internal audit plan for the year defined, the internal auditor will then carry out the audits of the general areas of the institution according to the plan. It is important to incorporate a risk-based element when determining the internal audit procedures you will complete for a given area. High-risk areas require more controls and more internal audit testing to verify the controls exist and are operating effectively. Low-risk areas do not have as many internal controls in place; as a result, internal audit testing could be kept at a higher level. Audit programs should be tailored to your organization based on the area’s existing controls, the effectiveness of those controls, and previous regulatory exam or internal audit recommendations related to the particular area.

Risk-based Reporting
Once an audit of a given area is completed, a report should be submitted directly to the audit committee, board of directors, or supervisory committee detailing the findings, recommendations or observations. You can also incorporate a risk-based element into this reporting process. You can choose not to include all technical or isolated exceptions in your reports and report specific exceptions only to management. Try not to place too much emphasis on specific findings and exceptions in these written reports. Instead, address questions such as “What caused this exception?” or “What process needs to be enhanced so that this does not happen again?” This manner of reporting helps to ensure that the audit committee, board of directors, or supervisory committee understands the process improvements and the value that an internal audit department brings to the organization.

Latest Insights

February 15, 2019
The purpose of this whitepaper is to provide construction entities with a quick and understandable reference guide for common issues in construction accounting. We have covered several topics we commonly receive questions about in the construction…
February 15, 2019
If a lien has been filed against you, it’s important to understand your options for release, discharge and subordination.
February 14, 2019
Firm News
The union adds a new office and state to the regional CPA firm and adds additional ERP talent to their growing NetSuite practice.
February 12, 2019
Your employees are the people most likely to catch fraud in the workplace. But how can you help them get over their fears of reporting it?
February 11, 2019
If you receive a letter from the IRS, it’s important to open it right away. This article outlines different types of IRS correspondence and what each one means for you.
February 11, 2019
The IRS is garnishing your wages. Now what? We break down wage garnishment and steps you can take to deal with this practice.