Seminar OutlineDAY – 1: Foundations of
Risk
RISK AWARENESS
- Three definitions of risk: the insurable; the
preventable; and the manageable
- The impact of risk
Practical exercise: the consequences of maturing
threats
- What is risk awareness?
- Distinguishing personal risk from organisational
risk
Practical exercise: revealing the differences between
personal and organisational risk
- Business processes and risk
- Embedding risk around and within business
processes
Practical exercise: examining a process and locating
risk
- Risk capability models – maturity models for
businesses
- Continuous risk improvement processes
FORMALISING RISK CONCEPTS
- Terminology and definitions – a quick primer
- Calculation of risk exposures
Practical exercise: simple risk calculations to gain
a high-level view
- Why we use different ways of assessing risk in
different situations
- Quantitative and semi-quantitative models
- Consequence based models
- Cause-effect models
Practical exercise: selecting and using the correct
risk model – practice at using different risk models
DAY – 2: Risk Architectures and auditing Risk
Management Systems
RISK ARCHITECTURE
- The notion of Enterprise Risk Management –
example: the COSO ERM
Practical exercise: justifying a formal approach to
the management of risk and creating enterprise risk
architectures
- From mission statement to objectives
- From objectives to risk
- From risk to control
Practical exercise: turning business objectives into
risk architecture – simple example
- Creating a Formal Enterprise Risk Architecture
using analytical techniques
- Context – Objective – Logical Architecture –
Physical Architecture
- Operational Architecture
- Integration of risk-control and risk-management
processes
Practical exercise: creating an enterprise risk
architecture from a cold-start
RISK MANAGEMENT AND THE AUDITOR
- The point of examining and auditing risk
management processes
- Determining the maturity level of the risk
management process
- The audit process – how to review the risk
management system
Practical exercise: auditing a risk management system
– this is a phased review and will be interspersed
between the key elements of this session
DAY – 3: Risk Driven Audit Planning and Risk
Driven Audits
THE MANDATE
- The audit charter and the audit universe
- The expectations of audit from legislators,
management and stakeholders – the non-audit viewpoint
Practical exercise: review of the audit charter and
stakeholder expectations
GATHERING DATA AND CREATING PLANS
- Risk assessment the key tasks
- Holding and managing self-assessment workshops
Practical exercise: hosting a risk workshop – a
participative exercise
- Compiling risk registers – the purpose and the key
elements
- Audit plans – the planning process
- Deriving audit plans from risk registers
Practical exercise: building out a plan of audit work
from risk register data
USING RISK TO DRIVE AN AUDIT
- Basic principles
- Defining scope and risk-based objectives
- Defining key questions
- Early thoughts about testing and proof –
reasonable assurance
- Drafting a management letter for a risk-based
audit
Practical exercises: defining risk-based objectives
PERFORMING THE AUDIT
Major Practical: Delegates will conduct a partial
review of an operational financial system using the
principles and knowledge acquired earlier in this day.
DAY – 4: Risk Driven Audits – Projects, IT Systems
and Service Delivery
RISK DRIVEN PROJECT AUDITING
- What is different about project risk?
- Risk strategies for projects: a risk checklist
Major Practical: Delegates will conduct a partial
review of a major project using the principles and
knowledge acquired earlier in this session.
RISK DRIVEN IT AUDITING
- What is different about IT risk?
- Application reviews: turning business objectives
into risk drivers for the audit
- Security reviews: turning security objectives into
risk drivers for the audit
Major Practical: Delegates will conduct a partial
review of an IT infrastructure using the principles and
knowledge acquired earlier in this session.
RISK DRIVEN SERVICE DELIVERY
- The difference between a service delivery and
operational audit perspective
Major Practical: Delegates will conduct a partial
review of a service delivery process using the
principles and knowledge acquired earlier in this
session.
DAY – 5: Control Evaluation and Reporting
PERFORMING A RISK-BASED AUDIT – EVALUATION OF
CONTROLS
- Major risk-controls: segregation; accountability;
effectiveness; integrity; transparency; currency;
registration; identification; authentication;
authorisation; completeness; accuracy; reconciliation;
traceability
Practical exercise: evaluating controls and tracing
risk back to objectives - demonstrating impact on
organization
- Defining testing strategies – reasonable assurance
- Compliance testing - weakness probing -
substantive testing
Practical exercise: designing and performing tests to
gain reasonable assurance
- Documentation: notifying control weaknesses
Practical exercise: notification of control
weaknesses and the risk linkage - demonstrating
connection to risk register
THE DRAFT AUDIT REPORT
- Structuring of draft reports and embedding risk
concepts: risk management implications and conclusions
Practical exercise: a draft report based on risk
THE FINAL AUDIT REPORT
- Structuring of final reports – the risk message
- Sign off – getting agreed risk action – escalating
critical risk issues
- Follow up of risk-based audit reports
Practical exercise: the final audit report
top |
