Risk auditing is a recipe for investor confidence

It is widely acknowledged that internal audits provide assurance about a company’s ability to comply with today’s fast changing and rapidly expanding regulatory environment. The process enables companies to enhance business performance in terms of managing and mitigating enterprise risks, specifically in the field of fraud, major capital programs, contracts, transactions, compliance and international business expansion.

As such, internal audits are conducted to evaluate the risk management processes in a company and to determine their relevance and effectiveness in addressing not only the identified risks, but also emerging trends regarded as potential risks. It is important to assess risks arising from both the internal and external environments, legal risks (such as directors’ liabilities) as well as compliance risks in terms of policies, procedures, laws and regulations among others.

The appropriateness of policies adopted by management, the effective use of resources, the prevention of undue risk and the management of identified risks are typically also considered during the risk auditing process.

Risk audits are used by leading companies worldwide to provide an independent and objective view of the risk environment and management of a company. The audit process provides management, boards, shareholders and other important stakeholders with a complete view of the risk profile of the company and the markets / business environment it operates in. As such, it is an invaluable tool used by management and boards to:

• Respond to increased stakeholder and regulatory demands;

• Exercise greater internal control;

• Exercise good corporate governance; and

• Improve and ensure effective risk management.

In addition to the above, the risk audit considers the extent to which the risk strategy is embedded in the company; the extent to which risks are managed by management and the board; the robustness of the risk management reporting process; whether the risk structure is appropriate to support management strategy; and whether there is adequate control over and mitigation of critical and emerging risks.

Other benefits of internal risk auditing include:

• It enables management to take ownership of and effectively communicate risk management to internal and external stakeholders.

• It provides management with timely and relevant information. As such, it gives companies a competitive advantage by enabling management to respond to emerging risks proactively or to revisit and rethink their approaches.

• Effective internal risk auditing has proven to have a positive impact on customer, investor and other shareholder relations. It impacts on profits over the longer term too, in the sense that demonstrating successful risk management to investors helps to improve financial results by increasing investor confidence in the company.

• The internal audit also provides assurance to investors, lenders, regulatory authorities and other stakeholders who are looking for greater accountability and transparency.

• Effective risk management policies can reduce costs for an organisation, particularly if the organisation as a whole understands the critical connection between risk management and performance improvement.

• Where a risk register is maintained, graded, ranked, reviewed and upgraded at regular intervals, internal auditing provides companies with an audit trail of the information used to draw its conclusions, evaluating the appropriateness and effectiveness of decisions made.

An effective auditing strategy ensures that all stakeholders, especially investors, have confidence in the companies’ ability to deliver on its promises. Internal auditing is invaluable in the sense that a rigorous risk identification and assessment process is in place, especially for high risk or unusual transactions.