View source for RIAM:Overview: Risk Based Planning (RBP)

==Introduction - The Result of the Internal Audit Planning Process==


The planning process results in a 3 year Strategic Internal Audit Plan and a 1 year Rolling Tactical Internal Audit Plan and a Risk Model for the organisation.  The Risk Model should integrate and utilise the corporate strategic risk plan.

===The Strategic Audit Plan and Tactical Audit Plans===

The Strategic Audit Plan details the:

* Objectives of the Plan and the Period Covered
* The Plan Scope and Boundary
* Principal Acts Effecting Operations
* The Total and Annual Man Day Requirements
* The Personnel and Skill Requirements (with estimated time requirements)
** Plan Administration and Criteria for Plan Modification
** The Activities to be Audited, Relevant Objectives and Procedures
** The Schedules
*** 3 Year by activity
*** Annual by activity
*** Annual by chronology
* The Tactical Audit Plan details the tasks, commencement dates, duration and (in later years) summarises the status of the tasks undertaken to date 

Auditable activities are identified within their organisational units together with:
* appropriate audit objectives and assertions,
* specific issues of legislative compliance,
* specific issues of management assistance to be addressed,
* the general types of procedures required to meet the objectives and establish or refute the assertions,


The working papers contain additional information such as records of interviews and background data.



===The Organisation Risk Model===

The risk model is initially developed during the strategic audit planning stage and continuously updated with the results of audit reviews, and improvement effects of the implemented recommendations or other management strategies and action plans.

==The Basis to Planning==


There are two pillars to the planning process proposed:
# Administrative Infrastructure for the Plan;
# The Plan.


The basis to the Plan is:

* Establishment of objectives
* Prioritising objectives
* Selection of appropriate goals
* Determine Procedures to meet goals
* Cost Procedures (in staff resources and time)
* Review and select most efficient procedures


The basis to the Administrative Infrastructure for the Plan is the need for administration of the plan and  flexible planning. The performance of a plan must be monitored during execution to ensure adherence and the need for additional or different audit resources. The detail of the plan must be regularly reviewed for the need to modify the plan for changing circumstances.


The administrative infrastructure supports these needs and provides the framework for change management. By separating it from the Plan, we highlight the importance of plan management in the Internal Audit function and allow separate budgeting, evaluation and control of the ongoing quality of the Plan.


==The Approach to Planning==

The primary objective of the approach is Management Assistance.


The Internal Audit section is ultimately a tool for management to use in controlling and tuning operations. The reports generated from the Internal Audit program must be seen by management to be relevant. We place a high emphasis on interviewing staff at all levels to help establish a comprehensive management assistance program. 


The objective is met by work programs that are focussed to five goals:

<table border=1 align=center>
<tr>
<th >ITEM</th ><th >OPINION FOCUS</th ><th >SUB FOCUS</th >
</tr>
<tr>
<td >
1
</td>
<td>
Reliability and Integrity of Information
</td>
<td>
* Accurate Information
* Reliable Information
* Timely Information
* Complete Information
* Useful Information
* Correctly Accumulated Information
* Fully and Correctly Disclosed
</td>
</tr >
<tr >
<td>
2
</td>
<td>
Compliance With
</td>
<td>
* Policies
* Plans
* Procedures
* Legislation
* Regulations and Treaties
</td>
</tr >
<tr >
<td>
3
</td>
<td>
Assets are Safeguarded.	
</td>
<td>
</td>
</tr >
<tr >
<td>
4
</td>
<td>
Efficient and Effective Use of Resources.	
</td>
<td>
</td>
</tr >
<tr >
<td>
5
</td>
<td>
Accomplishment of Goals, Objectives for Programs, Policies and Management's Critical Success Factors.	
</td>
<td>
</tr >
</table >


The goals are seen to be achieved through management's successful implementation and maintenance of control systems. These control systems are examined within the following ten classes:

<table border=1 align=center >
<tr><th>ITEM</th><th>CONTROL CLASS</th></tr>
<tr><td >1</td><td>Organisation of the section</td></tr>
<tr><td >2</td><td>Personnel</td></tr>
<tr><td >3</td><td>Policies</td></tr>
<tr><td >4</td><td>Procedures</td></tr>
<tr><td >5</td><td>Accounting</td></tr>
<tr><td >6</td><td>Budgeting and Planning</td></tr>
<tr><td >7</td><td>Reporting</td></tr>
<tr><td >8</td><td>Documentation</td></tr>
<tr><td >9</td><td>Internal Review</td></tr>
<tr><td >10</td><td>Physical Security</td></tr>
</table>

(These classes can be modified as necessary to a particular business entitie's environment.)

Each control class will have a control risk associated with it determined by the quality of its:

* Preventive Controls,
* Detective Controls, and 
* Corrective Controls.


The types of audit activities planned  will look to the 5 opinion goals by examining these ten control classes. The activities  are thus directed to standard audit and management identified areas of concern. Activities to be planned might include:

* Efficiency and Effectiveness Reviews
* Operations Research
* Control System Reviews and System Based Audits
* Performance Measurement Strategy Reviews
* Compliance Testing
* Applications Reviews
* ADP Reviews (Applications, Environment, Software development and change control, Data Integrity Reviews)
* Quality Reviews


==The Process of Planning==

<table border=1 align=center >
<tr ><td >
Planning and Familiarisation Phase
</td >
<td >
* Determine the overall objectives of the plan
* Determine Scope, Boundary and Timing of the plan
* Establish Quality Assurance procedures relevant to the overall planning objectives
* Establish how plan efficiency will be measured
* Establish risk ranking criteria
</td></tr>
<tr ><td >
Analysis Phase
</td >
<td >
Recursively categorise the organisation to be audited
<table >
  <tr ><td>
For each level and category of the organisation:
  </td>
  <td >
* Analyse and categorise the activities of the target level and component
* Determine relevant background data
* Determine projected changes during lifetime of plan
* Determine requirements for legislative (etc.) compliance
* Determine specific concerns and expectations of management
* Determine the objectives and goals of each category
* Determine assertions (performance standards) appropriate to achieving category goals and legislative compliance
* Rate the activities for auditability and risk
</td></tr>
</table >
</td></tr>
<tr ><td>
Specification Phase
</td >
<td >
* Direct the plan to meeting specific objectives through achieving specific goals in accordance with the risk rating and management directions
* Estimate time requirements and tune the plan to maximise the efficiency rating
* Identify skills required for each component of the plan
</td></tr>
<tr ><td>
Scheduling Phase
</td >
<td >
* Ensure plan is dynamic by establishing the process and conditions for plan execution, control, performance evaluation, modification and annual re-scheduling
* Schedule activities
</td></tr>
</table >


==Measuring Plan Efficiency==

Plan efficiency is measured by maximising the coverage of Auditable Areas addressing those with the highest risk (or priority) ranking first. The time allocated to each area will be a function of the complexity of the area, nature of existing control systems and specific concerns of management.


==Measuring Risk==

The measurement of risk may follow any one of a number of methods. Our planning strategy is largely independent of the method of risk assessment adopted. We expect that the selected ranking criteria will be the result of discussions with the client's management.

The primary restriction to risk analysis reflected in the proposed approach is the assumption that risks may be separated into:

# Inherent Risks
# Control Risks
# Detection Risks

The familiarisation and planning phase attempts to determine the inherent risks while the analysis phase forms preliminary judgements on the control risks. 

Detection risks are largely the responsibility of the planner and auditor. At the planning stage they are limited by a comprehensive planning methodology, project management and quality assurance program.

The starting point for discussions on ranking techniques might be the Weighted Average Scoring Technique. A common domain of variables is selected under which inherent and control risks may be analysed, and a ranking of 1 to 5 is determined. Variables might include:

<table border=1 align=center >
<tr ><td >Previous audit results</td><td>Employee Turnover</td></tr>
<tr ><td >Assets controlled</td><td>Unit Revenue/Turnover</td></tr>
<tr ><td >Confidentiality and Privacy</td><td>Legislative Compliance</td></tr>
<tr ><td >Systems maturity</td><td>Management Concern</td></tr>
<tr ><td >Change Control</td><td>Performance Indicators</td></tr>
<tr ><td >Complexity of the Systems</td><td>Workload volumes</td></tr>
<tr ><td >Administration</td><td>Public Relations</td></tr>
</table >

Techniques such as the Delphi technique are used to capture the key risk areas, or threats to the organisation, and gain a weighting for each threat area. The Delphi Technique is a one pass survey strategy in which management vote on relative importance of threats in pairs. The technique is suggested by the Institute of Internal Auditors in the Risk Analysis course.
After the risk variables are selected, the Weighted Scoring method calculates a score for each auditable activity based on percentage weights (totalling 100%) reflecting the relative importance of the variable. For example:

<table border=1 align=center >
<tr ><th>Weight</th><th>Audit Variable</th><th>Ranks</th><th>Weight * Rank</th></tr>
<tr >
<td>20 %</td><td>Maturity of System</td><td>
5. Less than one year<br>
4. Less than two years<br>	
3. Less than three years<br>	
2. Less than four years<br>
1. Greater than four years<br>	
</td><td>Eg 2 * .20 = .4</td>
</tr>
<tr >
<td>40 %</td><td>Yearly Expenditures</td><td>
5. $1,000,000 +	<br>
4. $500,000 to 1,000,000<br>	
3. $100,000 to 500,000<br>	
2. $10,000 to 100,000<br>	
1. Less than $10,000<br>	
</td><td>Eg 4 * .4 = 1.6</td>
</tr>
<tr >
<td>40 %</td><td>Privacy Exposure</td><td>
5. Most Exposure<br>	
4. Significant<br>	
3. Average<br>	
2. Moderate<br>	
1. Minimum Exposure<br>	
</td><td>eg 5 * .4 = 2.0</td>
</tr>
<tr >
<td ></td ><td >TOTAL RANK</td><td></td><td>4</td>
</tr>
</table>


The number of ranks (1 to 5 or 1 to 10) would be determined after preliminary surveys established the range of conditions relevant.

'''''The strategy requires the implementation plan and  procedures to be prepared in accordance with each client's different circumstances.'''''  

Professional judgement and experience are applied to identify and evaluate risks and to determine the most appropriate response.  '''''It is clear that a thorough understanding of the Organisation's business environment is necessary with the approach.'''''



==Backlinks==

[[RIAM:Overview of the Method| Back To The RIAM : Overview (Main)]]  ||  
[[RIAM:Overview: The Five Arms of RIAM - At a Glance | Back To The Five Arms - At a Glance]]