Strategic Thought

RM in your Role >

 Audit Department

The department is responsible for auditing your business, knowing where the risks lie, and that these risks are being documented and  something is being done about them.

This can be a daunting task given the size, complexity, and geographical scope of many companies today. How can we capture this information and how can we track it through yearly audit reviews? Also, we want to be able to add value to internal customers, so that they don’t just see the department as an information collector & policeman of policy.

Internal auditing's core role with regard to ERM is to provide objective assurance to the board on the effectiveness of an organization's ERM activities. This helps ensure key business risks are being managed appropriately and that the system of internal control is operating effectively.

Here are some of the benefits that an Enterprise Risk Management system can deliver to an Audit Department:

• ARM’s Audit History functionality provides the opportunity for auditors to drill through the key risk information to ensure that there is assurance and transparency across the business.
• Risk management analysis across the business units provides guidance for the auditing department on where to target audits, both current and future, and to provide corrective feedback in those areas where the risks to the enterprise lie.
• ARM’s evaluation and corrective action management functionality allows the auditor to play a key role in driving the risk process and improving business performance.
• ARM is a great way to demonstrate one coherent, standardized and deployed process across all or parts of the organization - giving overall assurance on risk management processes.
  
• The audit department needs to give an assurance that risks are correctly evaluated, and this can be done in ARM through the standardized scoring process. You can also put in notes under the Audit Review notes function that can be referred to and built on during multiple assessments and reviews.
• Use ARM to evaluate the reporting of key risks, and determine how this would be best accomplished to meet the goals of the stakeholders and the overall company.
• Use ARM to review, efficiently and effectively, the management of key risks and whether the controls and mitigations in place are effective. Also determine whether they are on track, and make decisions/give guidance on any further corrective action that should take place.