Generating a Big Impact with a Small Audit Staff-Strategy I

Strategy #1: Follow the Risk

Audit engagements are most likely to produce substantive results when they pinpoint areas of significant risk to the enterprise. We all know that our professional standards call for engagement plans based on risk assessments. At smaller internal audit shops, however, this important rule sometimes gets shortchanged. Most of us understand the importance of assessing risk as part of our annual planning process, but in the rush to complete individual audit engagements, we frequently skip the assessment phase of engagement planning. Small audit shops have fewer audit resources, and focusing those resources where risks are the greatest is often a key ingredient in generating high-impact results.

It’s important to remember the most common risk factors in audit planning. Each enterprise and business unit is different, but in general I like the list in Sawyer’s Internal Auditing, which identifies the most common risk factors as:

  • Timing and results of previous audits.
  • Materiality and liquidity.
  • Confidentiality.
  • System maturity.
  • Stability of the system.
  • Administrative controls.
  • Employee turnover.
  • Unit revenue and volume.
  • Performance indicators.
  • Public relations.

This is strategy 1 of 6.

From Richard Chambers, CIA, CGAP, CCSA


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s