Risk Assessment - Risk Assessment in Auditing

Risk Assessment in Auditing

For audits performed by an outside audit firm, risk assessment is a very crucial stage before accepting an audit engagement. According to ISA315 Understanding the Entity and its Environment and Assessing the Risks of Material Misstatement, "the auditor should perform risk assessment procedures to obtain an understanding of the entity and its environment, including its internal control."

Risk assessments performed by internal auditors are entirely different. They are usually designed to facilitate the annual audit plan. Using various elements, such as changes in volume of business, management, technology, and the economy, coupled with the knowledge and experience of management regarding the particular area, plus the previous rating of the area and the time since the last audit, the audit department determines which areas have more risk and should be a priority within the audit plan. These risk assessment are different than those prepared by the department. Those should be evaluated as part of the internal audit risk assessment process, but should not be the sole basis. Only internal audit department generated risk assessments should used for audit planning purposes. Likewise, internal audit should not be preparing risk assessments for the various departments. They should prepare their own. They are responsible for establishing policies and procedures designed to mitigate the risks identified by the risk assessment. It is internal audit's responsibility to evaluate the effectiveness of the departmentally prepared risk assessments and make recommendations for improvement.