Risk Based Auditing – Establishing a Methodology

The Institute of Internal Auditors defines risk based internal auditing (RBIA) as a methodology that links internal auditing to an organization's overall risk management framework. RBIA allows internal audit to provide assurance to the board that risk management processes are managing risks effectively, in relation to the risk appetite.

RBIA is at the cutting edge of internal audit practice. It is an area that is evolving rapidly and where there is still little consensus about the best way to implement it.  Executing on true risk based internal auditing requires more than an annual risk assessment for the internal audit plan.  It requires a pre-established methodology that includes defining the organization's risk appetite and risk tolerance utilizing measurements that include aspects of financial, compliance and operational metrics.  In addition, internal audit must be ready to put aside their typical checklists and standard work programs.  True risk based internal auditing goes far beyond setting the annual audit plan.  It incorporates cascading the process through to each individual audit as well as the audit reporting process.

This course is the second of three risk based auditing courses.  This course focuses on the establishment of a framework or methodology for risk based auditing and examining how to utilize risk based questions within the process steps.