These databases are also very time-consuming to maintain, and they are quickly outdated in any changing environment. An algorithm is a sequence of logical steps that produces a result. Once an algorithm is built to solve a problem, the algorithm can solve that class of problems over and over. Algorithms in risk assessment usually involve a mathematical equation that is applied to each of the organization's work units to measure the total risk in each unit. The guidelines 410 and 520 in the IIA Standards suggest that internal auditors should use risk factors to assess risk.
Risk factors are observable and measurable indications of the presence of risk.
Choosing a number of common risk factors and measuring their strength in each of the organization's work units creates a risk factor model. Experience shows that models work best with four to seven factors, but never more than ten. Some models using proportionate weights to distinguish relative importance within the group of factors, and others use equal weights. Risk models built with algorithms most often use spreadsheets for data capture and manipulation. Unlike the database approach, risk models using algorithms are useful even under conditions of growth and change.