The Institute of Internal Auditors has issued two new practice advisories that remind internal auditors to take a broad, holistic view of risk management to assure there are no gaps or redundancies in the assessment.

The IIA developed the two new pieces of guidance to help internal auditors have a more effective hand in assessing an entity’s risk-management process and to provide some comfort to an entity’s management and audit committee that controls are in place and risks are being managed adequately.

“The problem we’ve seen in the past is a lot of risk assessment is out there but it doesn’t look at it from the entire organization’s perspective,” said Holly Kidder, technical director for the IIA. “A lot of companies will look at IT risks, fraud risks, or operations risks, but it takes someone to look at all of those to assure all risks are covered and that there are no gaps or overlaps.”

The first practice advisory, titled "Using the Risk Management Process in Internal Audit Planning," addresses the implementation of a risk-based plan to prioritize the goals of the internal audit activity and ensure internal audit’s goals are consistent with departmental goals. It advocates a holistic, fully integrated approach to risk management applying to all aspects of an organization, which allows for the identification of key controls that internal auditors are responsible for auditing.

The second practice advisory, titled "Assurance Maps," addresses how the board of directors is responsible for ensuring that business-critical risks are being assured and adequately managed. An assurance map is an organization tool that prevents redundancies in the risk-management strategy, and it also assures risks aren’t falling through the cracks. It streamlines the risk-management process and provides assurance to the board of directors that all the important bases are covered, said Kidder.

The two new pieces of guidance were the top priorities for the IIA’s Professional Issues Committee, which has a “laundry list of topics they want to cover as far as risk goes,” said Kidder.

Topics