How do you combine risk management audits with other assurance functions?

All functions involved in conducting a risk management assessment have to use techniques and methodologies based on common understanding of risk culture, categories of risks, risk rating and responses. While every assurance function across the Three Lines Model might have a slightly different approach, the fundamentals of risk management have to be followed consistently across the board.

More than that, the culture of combining assurance functions can help organisations understand what is wrong in the overall risk management outlook of the company and understand how that will spiral downward and tickle down to all other assurance functions.

The idea of establishing and implementing an effective combining assurance functions is beneficial - provided it is comprehensively practical, nimble and value adding to the entire organisation. Over the years of my involvement with various aspects of governance, it is key for the assurance and control practitioners to first, have a comprehensive understanding about the organisational objectives, its timeline as well as the challenges dynamics - internally and externally. Following the above understanding, assurance functions now have the right and relevant perspectives, for them to establish, implement and manage processes that adds value, as well as ensuring assurance and integrity - for the entire organisation.

Risk management has to do more with the strategy and objectives for an organization than assurance. One time maturity assessment or compliance testing for risk management by independent internal audit should be enough. However, gauging the effectiveness and implementation of approved risk mitigation plans is important and can be regular. So combination with strategy or performance or key project management is more beneficial than with assurance functions.

Premièrement, l’assurance qualité garantit que le processus d’audit est cohérent et standardisé, ce qui améliore la comparabilité des résultats d’audit entre différentes périodes et entités. Deuxièmement, l’assurance qualité aide à identifier et à atténuer les risques et les faiblesses du processus d’audit, ce qui améliore la qualité et l’efficacité du cycle d’audit. Enfin, l'assurance qualité fournit aux parties prenantes l'assurance que le processus d'audit est mené conformément aux normes professionnelles et aux meilleures pratiques, ce qui renforce la confiance des parties prenantes dans le processus d'audit.

It all starts with the Enterprise Risk Management (ERM) function that develops a corporate ERM Policy and coordinates relationship with risk stakeholders across a company and externally. ERM has to engage all assurance functions to align views and develop a common approach toward risk management execution within all organizational levels.

In my experience, when the above is done carefully and meticulously, organisations will progress toward its objectives harmoniously with each audit functions complement each other.

Great insight! there is also need for regular analysis to compare results and recommendation of risk management audit from period to period to understand risk direction vis-a-viz current realities.

Define Objectives and Scope: "Clearly define the objectives and scope of your risk management audit, including the processes, controls, criteria, and standards to be evaluated." Map and Understand Assurance Functions: "Identify and map other relevant assurance functions within your organization, understanding their roles, responsibilities, and activities." Coordinate and Consult Regularly: "Establish a regular dialogue with other assurance functions, agreeing on expectations, deliverables, and timelines for joint efforts." Integrate and Leverage Outputs: "Review and analyze the reports, findings, and recommendations from other assurance functions to integrate them into your audit process."

In a matrix organization with various functional areas (such as procurement, risk management, sustainability, compliance, projects, etc.), it is crucial to ensure that each management system is comprehensively covered by the assurance strategy. For instance, the sustainability and project models may have periodic adherence measurements conducted by their functional areas, while internal control performs sporadic assessments, and internal audit reviews are carried out according to its specific scope. The most important aspect is to ensure that no area assumes the coverage of another and that the assurance model provides complete coverage of all risks and controls.

Organisations that can deploy the 3 lines of defence model (1st line operational ownership and management, 2nd line specialist risk oversight and 3rd line independent assurance) gain from optimising the efficient use of their resources, maintain the appropriate level of independence, and are able to deliver the most effective objective assurance. The 2nd line are able to apply their specialist knowledge and resources to help design and routinely the most effective form of risk management, and whilst the 3rd line might not have the resources to do this and if they were they could easily lose their objectivity; they can aid the 2nd line and the organisation as a whole by reviewing the skills, capability, and effectiveness of risk assurance,

Implementing the IIA's Three Line Model is the best way to prevent overlaps and misunderstanding of roles and responsibilities amongst various assurance functions. Ideally, your ERM Policy has to map all the key risk players within three lines and their roles.

Generally the problem here is ego of one audit function over another. Such ego is hen not properly managed can lead to suboptimal performances on behalf of all audit professionals. Hence, there is a need for clear definition of function with no single audit function having the superior responsibility over others. Once this joint responsibility is established, it is easy to walk through with sole objective of improving the effectiveness and productivity of all audit functions.

It's essential to strike a balance between collaboration and maintaining independence to ensure a robust risk management framework. Clear delineation of roles and effective coordination among assurance teams will be key to avoiding conflicts and maximizing the efficiency of resources. This holistic approach requires a comprehensive understanding of each function's outputs while staying vigilant to prevent any oversight of critical risk matters.

One of the challenges for a combined assurance functions to be effective is to appreciate perspectives being provided by various control functions. The ability to appreciate, prioritize, as well as understand the relevacy of various perspectives - anchored with the common organisational goals and GRC requirements - needs maturity beyond the facts of input received. Thus, it could be risky to establish combined assurance functions if there's lack of capability and maturity to analyse, understand and appreciate various perspectives based on input received. The combined assurance functions need comprehensive understanding on organisational goals, other key stakeholders' roles, and various GRC's requirements & deliverables

As shared, combining assurance functions require comprehensive input & perspective beyond the control functions. Thus, the risk-based approach would work only if the practioners of this approach have the required experience and maturity to blend those various perspectives. In addition, the ability to identify and prioritise key components are also vital for the combined assurance functions to work effectively. There will be many types of inputs and data that needs to be considered, thus the ability to identify, prioritise and link it based on relevancy would be key. Among others, usage of analytics, would be useful to facilitate effective and efficient data analysis involving huge amount of data from various sources.

Upholding the principles of independence and objectivity ensures the credibility of the risk management audit. The efficacy of risk assessment is upheld by adhering to professional standards, validating findings, and maintaining a collaborative yet critical stance. Emphasizing transparent roles and documented responsibilities fosters clarity, mitigating confusion and conflicts. Effective planning and coordination, facilitated by a shared assurance framework and calendar, promote efficiency and resource optimization. Integrating outputs from various functions in a risk-based manner underscores the integration's value, enabling the identification and prioritization of critical risk matters.

Training and Development: Invest in training and development programs that enhance collaboration among assurance professionals. Foster a culture of sharing knowledge and expertise across functions. Leadership Buy-In: Secure leadership buy-in and support for the integrated approach. Highlight the benefits of improved efficiency, reduced duplication, and a more comprehensive view of organizational risks.

It is helpful to do this by: Having combine assurance governance forum at senior level for oversight of combine assurance work. Members will include representation from all 3lines assurance units. There should be a terms of reference for Committee to include regular meetings evidence by minutes. All 3 assurance units should present risk base assurance plan for approval at the forum, this will help to ensure duplication of efforts. Regular catch ups will help to ensure the plan is being followed through.

Risk assessment helps assurance functions to identify and prioritize areas within the organization that pose the highest levels of risk. This ensures that audit resources are allocated to the most critical areas, maximizing the effectiveness of the audit function.

This holistic approach not only ensures that key questions are addressed but also aligns risk assessment with other assurance functions, fostering a well-rounded understanding of risk exposure. By providing a clear summary of results, findings, and actionable recommendations, this approach enhances decision-making and contributes to a culture of continuous improvement.

Integrating risk management audits with other assurance functions involves establishing clear objectives, collaborative planning, adopting a risk-based approach, sharing information, forming cross-functional teams, using common frameworks, leveraging data analytics, integrating reporting, and pursuing continuous improvement. This integration enhances an organisation's ability to manage risks, ensure compliance, and optimize operational performance in a streamlined and cohesive manner.

I think when we talk about risk management we are more focused on enterprise level risks when it comes to corporates. So alignment with strategy and key performance indicators etc. is more important than integration with assurance functions though the final reports should be shared with each other to aid in highlighting critical areas. Risk management should be robust and address real risk to business along-with mitigations plans which if not followed will bring adverse results for the entity. So overall I am not in favor of combining assurance functions, yearly meet ups and sharing reports will serve the purpose.

A combination can be successful if the auditors used can be deployed in several audit fields. So if you are planning a combination, you should take this aspect into account when selecting future auditor.

Resource Allocation Efficiency Conflict Resolution Mechanisms Training and Skill Development Compliance with Regulatory Standards Risk Culture Integration Technology and Automation Stakeholder Communication Strategy Continuous Improvement Framework Diversity and Inclusion in Teams Data Privacy and Security Considerations