This article first appeared in New Perspectives on Healthcare Internal Auditing in 1996. The article assesses the state of development of risk assessment using a healthcare example from our consulting practice. Risk assessment is a key skill for healthcare auditors. Risk assessment is used to identify, measure, and prioritize risks so that the greatest effort is used to address the auditable areas of greatest significance.
Risk assessment is one means of allocating resources to meet the auditing needs of the organization.
Risk assessment is used also within the individual audit to identify areas within the audit scope that are most important. Risk assessment allows the auditor to design an audit program that tests the most important controls or tests the controls at greater depth or with more thoroughness. The junior auditor was instructed to follow the plan and perform the work. The training of many healthcare auditors is just this journeyman-apprentice relationship. Auditing using checklists, without an appreciation of why the auditor is doing some particular task or test, is auditing without an understanding of the risks and possibly without an understanding the business process either.