Background The purpose of this statement is to describe the elements of the risk assessment process for use by the internal auditing department. These elements include identification of the auditable activities, identification of relevant risk factors, and an assessment of their relative significance. Risk assessment is a process that is crucial to the development of effective audit work schedules. In developing an audit work schedule, the director of internal auditing should allocate the resources of the internal auditing department in a manner that gives appropriate consideration to the various risks confronting the organization. Risk assessment enables the director of internal auditing to assess ongoing audit requirements.
All organizations encounter risk.
Risk affects the organization's ability to compete, to maintain its financial strength, and to maintain the quality of its products or services. There is no practical way to reduce risk to zero. Accordingly, management must continually make judgments as to the level of risk it is willing to accept. This statement is not intended to prescribe a rigid process that specifies how risk assessment must be conducted. The risk assessment process described in this statement usually will be conducted annually.