How can you develop the skills to audit and review risk management?

When an audit of the risk management practice is performed by the same department that implements it, this situation can lead to a conflict of interest. Following the ERM best practices, audits should be performed by an independent assurance provider, such as an internal audit or external parties. To avoid misunderstanding and for the purposes of an overview, this exercise should be named a self-evaluation rather than an audit. Self-evaluation doesn’t replace an independent audit.

Oh dear. ISO 31000 is a framework, not an auditable standard and the IIA standards have little to do with the question. 31000 helps guide the building blocks for risk management but it is a paint by numbers approach. You can have a fully compliant approach with 31000 that is ineffective. The starting point has to be on whether risk management is effective, and the starting point for this has to be what risk management is trying to achieve and whether it is achieving it. Unfortunately there are many maturity models that suggest more process creates better risk management. Often the opposite is true. The review needs to be led or supported by a SME who has seen RM in different contexts and knows why they work and why they don’t.

Before you dive into auditing and reviewing risk management, you've got to get to know the rules of the game. It's a bit like learning the playbook in sports. So, your first step is understanding the standards and frameworks that steer risk management and the Institute of Internal Auditors (IIA) International Standards for the Professional Practice of Internal Auditing. These standards give you the principles and guidelines you need to set up, run, and assess risk management systems and activities. Think of it as your roadmap for making sure everything's on track. Take the time to get familiar with these standards and how they fit into your organization and industry.

Review is different from Audit. Review is self assessment, which is an internal check on the processes and thresholds, with a particular frequency. Audit, is more of maker-checker concept, where it needs to be done by an independent internal or external agency. On the skills needed- understanding of the risk frameworks, previous audit history and comments, process and controls of the org from various stakeholders, is extremely important. Audit is more serious than review and can point out serious red flags in the internal controls, processes which needs to be taken with utmost seriousness to plug the gaps. That's the primary objective of an audit.

Understanding international standards and best practice is important. However, an understanding of the standards, processes/ procedures and risk relevant to the audit area is key in putting together the required skill mix for any audit. This then supports the other steps in the audit process.

When planning for self-evaluation, it’s important to have a clear goal in mind. What are we trying to assess here? Is it effectiveness and maturity of the risk management practice? Is it efficiency and agility? Is it compliance with the latest standards and regulations? To avoid a “scope creep”, define what exactly is being assessed.

?? Clearly define the scope, objectives, criteria, and methodology of the audit or review. Identify the stakeholders, resources, and timeline. Conduct a preliminary risk assessment and document the audit or review plan. ?? Importance: Planning helps to: ??Ensure that the audit or review is focused on the most important areas. ??Identify potential problems early on. ??Make the most efficient use of resources. ??Produce a high-quality audit or review report.

Very important to mention here, the approach. There are 3 approaches to assess the effectiveness of the Risk management 1. Review the elements 2 review the principles 3. CMM capability Maturity Model. I think that is the most relevant in this step. Maturity (from my opinion is the most valuable) is one of the approaches we can use to determine the effectiveness.

An audit is different from a review and the former should be conducted by an independent party. Planning any audit or performing a review follows the same process regardless of what area is being assessed. Most importantly, clarify the scope and deliverables. Obtain as much relevant information as possible about the function, its objectives, policies and targets. Schedule initial walkthroughs with senior management to form a preliminary view of the area and its most material risks. This will help determine the scope, objective, timelines and resource required.

Para desenvolver habilidades em auditoria e revis?o de gest?o de riscos com foco no planejamento da revis?o da auditoria, siga estes passos: 1. **Educa??o**: Gradua??o em finan?as, contabilidade ou áreas correlatas. Obtenha certifica??es como CRMP, CIA ou CISA. 2. **Conhecimento de Padr?es**: Estude ISO 31000, COSO ERM e Basel. 3. **Habilidades de Auditoria**: Fa?a cursos e entenda metodologias de auditoria. 4. **Experiência Prática**: Trabalhe em gest?o de riscos ou auditoria, participe de estudos de caso. 5. **Planejamento de Auditoria**: Desenvolva planos detalhados com objetivos, critérios, escopo, abordagem, recursos e cronograma. 6. **Manter-se Atualizado**: Participe de workshops, webinars e associa??es profissionais.

When collecting data, count in all the changes in the making. Pay particular attention to gathering data around events and practices that are repetitive and have a significant human error factor involved.

Collecting evidence starts from planning as this is needed to assess the scope and areas of material risk. Evidence can come in many forms including documentation, dashboards, surveys. However it is important to obtain first hand communication to understand what is not written down and what any areas of concern are. Collecting evidence therefore carries on into the fieldwork/testing stage before reporting.

Leveraging my extensive 8 years of experience in banking and financial institutions as an Auditor and Risk Manager, I recommend a multifaceted approach to skill development in auditing and reviewing risk management. This involves continuous learning, pursuing relevant certifications, networking with industry professionals, gaining cross-functional exposure within the organization, honing technology proficiency, analyzing case studies for practical insights, developing essential soft skills, and seeking mentorship for guidance in navigating complex audit and risk scenarios.

Evidence should be collected and sorted in proper order. When writing the report and giving reference to your evidence the recommendation will be valued by the management. This will help to clear any misunderstanding with the management.

When collecting and analyzing evidence for auditing risk management, focus on a risk-based approach by gathering sufficient, relevant, and reliable evidence from multiple sources while maintaining objectivity, professional skepticism, and clear documentation. Use analytical tools, validate data, and communicate effectively with stakeholders. Adhere to legal, regulatory, and ethical standards, ensuring confidentiality and independence. Avoid relying on single sources, making assumptions, or rushing the process, and do not ignore red flags, stakeholder input, or feedback. Present all evidence accurately without manipulation to maintain the credibility and effectiveness of the audit.

Avoid communicating the results in dry data terms. Connect the dots to depict a bigger picture. What does work well? What does require improvements? And most importantly, what are the recommendations and steps that should be implemented to achieve enhancements?

In my experience, results are best communicated through a combination of a phyiscal report which is succinct, clear and factually accurate as well as a meeting to summarise the findings & explain what really matters.

A successful report will include management responses. This response indicates that management had read the recommendation and is committed to implementing it. The management response should include the responsible person and the due date for implementation. This will insure the accountability for implementing the recommendations.

Reporting and communicating results effectively is key in auditing and reviewing risk management. Crafting a comprehensive report that outlines purpose, methodology, findings, and recommendations ensures clarity and transparency. Using clear, concise language supported by evidence strengthens the credibility of the report. Engaging relevant parties and soliciting feedback fosters collaboration and continuous improvement.

Set up a clear improvement plan to implement enhancements. Break down actions to short-term and long-term as they will require different timeline and level of resources. Advocate for resources and collaborative partnership to materialize your plan.

Follow up can also be termed as issue validation. Raising issues/recommendations/findings is important but its more important to assess how these have been addressed and to validate the actions taken. This is ultimately the purpose of the audit or review i.e. to enhance the risk and control environment.

Risk management is constantly evolving. Stay up to date with the latest developments, such as risk quantification and AI integration to expand your toolkit and knowledge. Join professional forums to exchange ideas and expertise with peers and adopt new techniques.

Improving your risk audit skills is like getting better at a game. You practice, learn from your performance, and keep up with the latest strategies. Taking classes, reading, and being part of a group can all help you get even better at it.

Continuous learning and improvement are essential in mastering risk management auditing and reviewing. Reflecting on performance and feedback helps identify areas for growth. Seeking opportunities like training courses, workshops, and conferences, as well as staying updated on latest trends and best practices, ensures ongoing development. Engaging with professional networks and associations also fosters knowledge exchange.

One more way that Internal Auditors can develop skills of audit and review risk management more effectively, is to first of all, learn and have a holistic view of the organization as interconnected systems, to understand how different parts influence each other and contribute to risks. With the aid of tools like fishbone diagrams, it is handy to more effectively identify underlying causes of risks rather than just symptoms. Recognise how actions and decisions create feedback loops that affect risk exposure, enabling proactive adjustments. Continuous improvements will come from engaging in iterative cycles of learning from experience of audits and feedback, to refine risk management strategies continually, enhancing quality of outputs.

Consult with your internal audit function before executing an assessment. They are well positioned to provide the right guidance on acceptable methodologies and techniques.

Only risk practitioners can audit risk management and be able to analyse and review strategies, frameworks and practices with confidence. Creating toolkits for foundation level risk managers will help others to build on their expertise to conduct audits as well.

The basic thing is understanding the PROCESS and it was repeatedly mentioned. The underlying knowledge for Audit work is understanding of the PROCESS

One thing I found useful is understanding the elements of the Risk Framework which are; Risk strategy & risk appetite Risk Governance Risk Culture Operational Risk Assessment &measurement Operational risk management & monitoring Operational risk reporting & insights Operational data & technology.

This is not answering the question. The focus is on how to conduct an audit whereas the question is about gaining the skills needed to effectively review risk management.