Therefore we can focus our audit attention on the more important risk issues we are facing and be increasingly efficient. This is a true risk-based approach because we have a methodology that our staff can follow and a focused risk assessment tool they can use. Our tool measures and contrasts inherent risks and related controls. Contrasting inherent risks and controls may be a technique others are using, but it allows us to assess specific business risks, rather than only residual risks. Northern Trust's management committee, audit committee and various risk committees all review and measure IA performance.
Performance measurement encompasses an assessment of how effectively issues are reported.
At Northern, the IA group provides succinct reports which identify issues and recommendations, describe the risks and set forth remedial actions being taken. The report format facilitates follow-up and issue tracking. We examine systemic issues that need attention and partner with management to help identify problems and solutions. In fact it is far more difficult, complex and valuable to analyze the issue, help identify solutions and report back to management on the status of the solutions. We have implemented management reporting techniques that force us to follow through with issues.