Continuous Business Risk Assessment

1. Continuous Business Risk Assessment

2. About BYU • Private, Church-sponsored • Founded 1875 • Three campuses • Provo, Utah (30,000) • Rexburg, Idaho (14,000) • Laie, Hawaii (2,000) • Internal Audit: 11 professionals, • 10 associate (student) auditors

3. Why? Our current risk assessment model is • It no longer enables us to keep up with emerging risks in a dynamic business environment; • Assumes management/auditor omnipotence • One year cycle time is just tooooo long to formally address risks • Relies on single method of harvesting risk information (annual survey) • No method for prioritizing work • Annual audit plan becomes the “Hotel California” of audit projects • Risks working with blinders on. bro ken

4. Why? • Comply with IIA Performance Standards • Ensure alignment with University mission and objectives • Add value to our audit customers

5. Questions • Are you following, unchanged, the audit plan you developed for 2003? “Most often used measures (of internal audit effectiveness) are absolutely dysfunctional. I think of one: you do your annual audit plan and commit to the audit committee that you’re going to do X number of these audits for the coming year.” --Dr. James Roth

6. Internal Auditing Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

7. Best Practices • Extensive Staff Expertise • Challenging Work Environment • Organizational Alignment • Participative, Qualitative, Real-time Risk Assessment • An Array of Audit Services February 2003 Internal Auditor

8. Array of Audit Services • Risk-based audits – working with management to identify the business risks they face. • Process audits – auditing an entire business process rather than an organizational unit and looking for ways to improve the process instead of simply trying to find control weaknesses. • Pre-implementation reviews – participating on new-product or system-development teams and/or reviewing the project at certain defined milestones. • Self-Assessment – hosting workshops, administering questionnaires, and conducting structured interviews to address soft controls. • Internal-Control Education – formal training programs designed and taught by internal auditors, as well as ad-hoc training, when needed, during assurance or consulting projects.

9. Internal Audit Tools • Control Self-Assessment Workshops • Client-Relationship Management • Relationship Development • Client Training • Control Model Mentoring • Computer-Aided Exception Identification (Continuous Auditing) • Process Improvement Programs (Quality Improvement, Continuous Improvement) • Team Facilitation • Improvement Models

10. Internal Audit Tools • Process Mapping/Control Evaluation (SOx, FCPA) • Risk-based Auditing • Maturity Model Evaluation/Implementation • Management Review • Risk Management Council • Improvement Models • Accountability • Continuous Improvement

11. Continuous Business Risk Assessment Continuous Risk Assessment is a participative process whereby we evaluate emerging risks on a continuous, qualitative, real-time basis rather than on an annual basis.

12. Participative • Involve more than Internal Auditors • Seek out managers and employees who know and understand emerging risks.

13. Continuous • Periodic vs. Annual • As frequently as needed • Various sources of information (meeting, conference, workshop, survey, interview)

14. Qualitative • Relies on professional judgment • Includes political and strategic factors as well as traditional measures • Involves more than one opinion

15. Real-Time • Results in changes to the audit schedule NOW • Decisions made in close proximity to issue and risk identification

16. R Event Identification i s k Risk Assessment Risk Assessment Process Risk Response Process Imp. Audit Risk Evaluation & Response Mgt. Review Action Plan Mgt. Conf. Control Doc. Investigation

17. Audit Population Risk-Based Audits & Requested Services Strengthening Control Environment Compliance Monitoring

18. CBRA Risk Response Prioritize Projects Event/Project Identification Risk Assessment

19. CBRA Risk Response Prioritize Projects Event/Project Identification Risk Assessment Drop Analysis Initiate

20. Risk Tracking Log • Access Database • Three Screens • Input Log • Evaluation Screen • Strategic Considerations

21. Audit Project Portfolio • Excel • Categorized

22. What We Get • Increased capability to systematically respond to business risks • Increased ability to identify risks by expanding and improving risk information harvesting methods • Improved utilization of Internal Audit resources • Compliance with IIA Performance Standards • Overall, a more mature risk assessment process

23. Standards Summary • Risk-based plan of engagements • Develop at least annually • Determine priorities consistent with organization’s goals • Consider input of senior management and board • Identify significant exposures to risk • Consider consulting proposals

24. Impacts • More time identifying, characterizing and evaluating risks. • Need more flexible audit schedule. • Trust in consensus/professional opinion.

25. Copy of slide presentation • Access database template (Tracking Log) • david_galloway@byu.edu

26. Continuous Business Risk Assessment