The guidelines 410 and 520 in the IIA Standards suggest that internal auditors should use risk factors to assess risk. Risk factors are observable and measurable indications of the presence of risk. Choosing a number of common risk factors and measuring their strength in each of the organization's work units creates a risk factor model. Experience shows that models work best with four to seven factors, but never more than ten. Some models using proportionate weights to distinguish relative importance within the group of factors, and others use equal weights.
Risk models built with algorithms most often use spreadsheets for data capture and manipulation.
Unlike the database approach, risk models using algorithms are useful even under conditions of growth and change. Once created and its results validated, the algorithm can be used on new business processes as well as current work units. Assumptions used in building the algorithm's mathematical relationships can be explained and used as a training tool. The investment in initial data gathering is modest, and the ongoing maintenance effort is very low. The only drawback to using an algorithm for risk assessment is the broad business knowledge required of the assessment team.