Once an algorithm is built to solve a problem, the algorithm can solve that class of problems over and over. Algorithms in risk assessment usually involve a mathematical equation that is applied to each of the organization's work units to measure the total risk in each unit. The guidelines 410 and 520 in the IIA Standards suggest that internal auditors should use risk factors to assess risk. Risk factors are observable and measurable indications of the presence of risk. Choosing a number of common risk factors and measuring their strength in each of the organization's work units creates a risk factor model.
Experience shows that models work best with four to seven factors, but never more than ten.
Some models using proportionate weights to distinguish relative importance within the group of factors, and others use equal weights. Risk models built with algorithms most often use spreadsheets for data capture and manipulation. Unlike the database approach, risk models using algorithms are useful even under conditions of growth and change. Once created and its results validated, the algorithm can be used on new business processes as well as current work units. Assumptions used in building the algorithm's mathematical relationships can be explained and used as a training tool.