IIA defines risk based internal auditing (RBIA) as a methodology that links internal auditing to an organisation's overall risk management framework. RBIA allows internal audit to provide assurance to the board that risk management processes are managing risks effectively, in relation to the risk appetite.
By following RBIA internal audit should be able to conclude that:1.Management has identified, assessed and responded to risks above and below the risk appetite2.The responses to risks are effective but not excessive in managing inherent risks within the risk appetite3.Where residual risks are not in line with the risk appetite, action is being taken to remedy that4.Risk management processes, including the effectiveness of responses and the completion of actions, are being monitored by management to ensure they continue to operate effectively5.Risks, responses and actions are being properly classified and reported.
This enables internal audit to provide the board with assurance that it needs on three areas:1.Risk management processes, both their design and how well they are working2.Management of those risks classified as 'key', including the effectiveness of the controls and other responses to them3.Complete, accurate and appropriate reporting and classification of risks
To those who are intereste, I can share an excellent presentation by Grant Thornton on the subject.The presentation is in both Arabic And English and it discuses the following issues:
- Definition of risk based internal audit
- Risk based internal audit requirments
- Tradittional approach vs. Risk based approach
-Risk based audit stages
If you which to receive a copy of the presentation ,send your email to
