Topics in this domain
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
Risk-Based Audit Approach
You can’t check everything
An audit team has limited time and people. A company has thousands of processes, systems and transactions. If auditors spread their effort evenly, they’d spend as long checking the stationery cupboard as the payment system.
A risk-based approach fixes that: spend the most effort where a problem would hurt the organisation most. ITAF requires it, both for choosing what to audit each year and for planning each individual audit.
Think of a home inspector. Before buying a house, they check the roof, the wiring and the foundations carefully, and barely glance at the paint. A leaky roof costs thousands; a scuffed wall costs nothing. Auditors think the same way.
The steps
| Step | What the auditor does |
|---|---|
| 1. Understand the business | Goals, processes, systems, regulations, recent changes |
| 2. Find the risks | What could go wrong, how likely, how bad (inherent risk) |
| 3. Find the key controls | The controls that stop or catch the big problems |
| 4. Test the controls | Compliance tests: do they actually work? |
| 5. Test the data | Substantive tests, as much as the control results require |
| 6. Report | Findings ranked by risk, with recommendations |
The exam loves the first step. Before any testing, before writing the audit program, before choosing sample sizes, the auditor needs to understand the business and its risks. You can’t judge what’s risky in a business you don’t understand.
What risk decides
- What to audit: high-risk areas go in the plan and get audited more often.
- How to test: higher risk calls for stronger evidence, such as re-performing a calculation instead of asking someone.
- How much to test: higher risk calls for bigger samples, or testing everything with data analytics.
This links to the audit risk model: the auditor assesses inherent risk (how error-prone the area is) and control risk (how good the controls are), then decides how hard to look.
Where the auditor gets risk information
- business strategy and goals
- organisation charts, process and system documents
- management’s risk register (a good start, but checked, not copied)
- previous audit reports and how quickly findings got fixed
- regulator reviews
- recent changes: new systems, mergers, outsourcing, new laws
- industry trends and current threats
Example. An auditor plans a review of a bank’s online banking. Instead of testing every line of the security standard equally, they rank the risks. Account takeover and payment fraud are likely and very damaging, so authentication, payment confirmation and fraud monitoring get detailed testing. A typo on the help page gets a quick glance at most.
The catch
A risk-based approach is only as good as the risk assessment behind it. If a risk is missed or misjudged, that area gets too little attention. That’s why the assessment is updated whenever things change, and why lower-risk areas still get looked at now and then.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| First step in planning an audit | Understand the business and identify the risks |
| Main benefit of a risk-based approach | Audit resources go to the highest-risk areas |
| What drives the nature, timing and extent of testing | The risk assessment (inherent and control risk) |
| How to treat management’s risk assessment | Use it as input; evaluate it independently |
| Why the plan changed mid-year | A significant change in risk: new system, incident, regulation |
In short
- A risk-based audit focuses effort on the areas where problems would hurt the organisation's objectives most.
- The first step is always understanding the business: its goals, processes, systems and the risks to them.
- Risk decides what gets audited, how it's tested, and how much testing is done.
- The auditor assesses inherent risk and control risk to decide how much testing is needed.
- Management's own risk assessment is a useful input, but the auditor forms an independent view.
- The risk assessment is updated when things change: new systems, incidents, regulations.
Exam traps
- Reviewing last year's report and interviewing management are useful, but understanding the business and its risks comes FIRST.
- Auditors don't test every control equally. Key controls over big risks get the most attention.
- Copying management's risk assessment without evaluating it isn't a risk-based approach.
- A risk-based plan isn't fixed for the year; it changes when risks change.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The steps
What risk decides