Please enable JavaScript.

Coggle requires JavaScript to display documents.

Risk Assurance - Coggle Diagram

- - - - maintenance of reliable systems;
      - timely preparation of reliable information;
      - safeguarding of assets;
      - optimum use of resources;
      - preventing and detecting fraud and error.
  - - - Objectives should be established and communicated.
      - Significant Internal and external risks should be identified and assessed.
      - Policies should be established, communicated and practised.
      - Plans should be established and communicated.
      - Plans should include measurable performance targets and indicators
    - - Shared ethical values should be established, communicated and practised.
      - HR policies should be consistent with ethical values.
      - Authority, responsibility and accountability should be clearly defined.
      - Mutual trust should be fostered to support the flow of information
    - - People should have the necessary knowledge, skills and tools.
      - Communication processes should support the values of the organization.
      - Sufficient and relevant information should be identified and communicated.
      - Decisions and actions within the organization should be coordinated.
      - Control activities should be designed as an integral part of the organization.
    - - Environment should be monitored to re-evaluate controls.
      - Performance should be monitored against the targets.
      - Assumptions behind objectives should be periodically challenged.
      - Information needs and related information systems should be reassessed.
      - Procedures should be established to ensure appropriate actions occur.
      - Management should periodically assess the effectiveness of control.
- - - - Initial contact: to inform the client(audittarget) or involved association about the auditing and its objectives.
      - Initial meeting: conference meeting, so that the client can describe the areas for review and state the available resources and processes.
      - Preliminary survey: the auditors will gather all the needed data so they can have a good overview of the auditing.
      - Review internal control structure: the auditor will determine the priority areas for the audit to review.
      - Audit programme preparation: the audit programmes will outline the required fieldwork related to the audit topic/area
    - - Testing for the critical internal controls: this process tests if randomly selected records are accurate.
      - Regular updates: the auditor will carry out financial reporting, mostly in oral communication and the client may help in resolving any issues raised.
      - Drafting the audit summary: when fieldwork is done, the auditor will summarize findings, conclusions and recommendations
    - - Audit report: the report will be reviewed by the audit team before presenting it to the client for further review.
      - Creating the report: comments and suggestions on the first draft are taken into account in producing the final report.
      - Distribution of the final audit reports to people involved, senior management, audit committee, as agreed
    - - Audit Follow-up: response from the client will be reviewed, so that the findings may be tested and resolved
      - Reporting the audit follow-up: the effects of resolved and unresolved findings will be included in the follow-up
  - - - management has primary responsibility for the management of risk;
      - specialist risk management functions can assist management in developing an approach to fulfilling their responsibilities;
      - the internal audit function checks that the risk management process and the risk management framework are effective and efficient.
  - - - giving assurance on risk management processes
      - giving assurance that risks are correctly evaluated
      - evaluating risk management processes
      - evaluating the reporting of key risks
      - reviewing the management of key risks
    - - facilitating identification and evaluation of risks
      - coaching management in responding to risks
      - coordinating ERM activities
      - consolidated reporting on risks
      - maintaining and developing the ERM framework
      - championing establishment of ERM
      - developing RM strategy for board approval
    - - setting the risk appetite
      - imposing risk management processes
      - management assurance on risks
      - taking decisions on risk responses
      - implementing risk responses on behalf of management
      - accountability for risk management
- - - - recommend the appointment and re-appointment of external auditors
      - review the performance and cost-effectiveness of the external auditors
      - review the qualification, expertise and independence of external auditors
      - review and discuss any reports from the external auditors
    - - review internal audit and its relationship with external auditors
      - review and assess the annual internal audit plan
      - review promptly all reports from the internal auditors
      - review management response to the findings of the internal auditors
      - review activities, resources and effectiveness of internal audit
    - - review the annual and half-year financial results
      - evaluate annual report against requirements of the governance code
      - review disclosure by CEO and CFO during certification of annual report
    - - review arrangements for producing the audited accounts
      - monitor and review standards of risk management and internal control
      - develop a code of ethics for CEO and other senior management roles
      - annually review the adequacy of the risk management processes
      - receive reports on litigation, financial commitments and other liabilities
      - receive reports of any issues raised by whistleblowing activities
  - - - Culture measurement – by use of a recognized framework such as CoCo or COSO in order to gain a quantitative evaluation of the control environment.
      - Audit reports – produced by internal audit and external auditors on a range of issues including risk assessment, implementation, compliance and training.
      - Unit reports – on such issues as risk performance indicators, CRSA, response to audit recommendations and reports on incidents that have occurred.
      - Performance of the unit – on risk-related issues, losses, significant weaknesses in control measures and details of any material losses suffered by the unit.
      - Unit documentation – on topics such as the risk management policy, health and safety policy, business continuity plans and disaster recovery plans.
- - - - risk management administration;
      - risk response and improvement plans;
      - event reports and recommendations;
      - risk performance and certification reports.
    - - Risk Management Processes
        
        Ensure that RM is incorporated within normal processes.
        
        Identify the principal risks facing the company.
      - Principal risk and risk appetite
        
        Assessment of risks to the business model and strategy.
        
        Risks the organization is willing to take or ‘risk appetite’.
      - Risk culture and risk assurance
        
        Risk culture is embedded throughout the organization.
        
        Adequate RM and assurance discussions take place at the board.
      - Risk profile and risk mitigation
        
        Risk profile of the company is kept under review.
        
        Measures to manage or mitigate the principal risks are taken
      - Monitoring and review activities
        
        Monitoring and review of risk management is undertaken.
        
        Monitoring and review is ongoing and notjust annual.
      - Risk communicating and reporting
        
        Internal and external risk management communication takes place.
        
        Necessary risk information is communicated to and from the board.