Risk analysis and assessment are not foolproof but the processes are better than relying on intuition. Educated decisions can be made about the selection of internal audit engagements.
A risk assessment process should be conducted annually. But the resulting engagement plan cannot be static. Changes in management direction, objectives, emphasis and focus as well as other evolving factors such as emerging trends should be reflected by changes to the audit universe and related engagement plan. Frequent (quarterly) updating may be required and any significant changes should be submitted to the oversight entities for review and approval.
No comments:
Post a Comment