Question

(ACCT-Internal Auditing)

In some organizations, risk assessment workshops are set for key teams as a response to the trend toward control risk self assessment programs, often on the back of recommendations from the auditors or an external consultant. Teams will get together to discuss risk, risk management, and relevant actions. In this way, it helps address the auditor concern, build up risk registers, and prepare summary reports for top management and the board. The board then reports that it has reviewed internal controls, partially through the use the risk management process as described. Please discuss the shortcomings of such a typical arrangement.

Answer 1

ANSWER:

The internal control is an integral part of risk management in an organisation. An efficient risk management program stipulates requirements of internal control that need compliance while making strategic positioning or taking decisions related to organisation expansions, portfolio adjustments, and other important concerns. A sound system of internal control mandates with an evaluation of the nature and extent of risks at periodic intervals, and remains flexible for the adaption of changes in the risk environment.

Internal controls remain indispensable for risk management, for mere awareness of risk does not ensure an efficient approach to manage the risk. Without internal controls, management might perceive risk mapping as an unnecessary hindrance, and thus prefer to ignore it for the expediency sake. The success of internal control and risk management depends on reliable information and communication. The lack of understanding of the standards themselves among few auditors can also create problems. Moreover these are assessments are usually unnecessarily paper intensive. Furthermore when the results from the risk management and control assessment are not linked with other users of the information thus there will be limited leverage possible. Also the changes in modified opinions and audit fees are positively associated with changes in reported internal control weaknesses.