Domain 1 Assurance Engagements - Risk & Control Assessments

Question 1

What are assurance engagements?

Answer 1

Objective examinations of evidence for the purpose of providing an independent assessment on governance, risk mgt and control processes for the organisation.

Internal auditors provide reasonable assurance that organisational goals are being accomplished.

These engagements are bounded work with a predefined audit scope that is fixed.

Question 2

Is the internal auditors role different between assurance engagement and consulting engagement?

Answer 2

Yes due to different objectives and outcomes of these objectives.
Best audit practice not to assign the same auditor to perform assurance engagement and consulting engagement

Question 3

Assurance engagements can include 15 topics

Answer 3

1. Risk and control assessment
2. Third party audits
3. Related party audits
4. Construction audits
5. Security audits
6. Privacy audits
7. Performance audits
8. KPI reviews
9. Balances scorecard reviews
10. Contract audits
11. Financial audits
12. Operational audits
13. IT audits
14. Compliance audits
15. Quality audits

Question 4

What is a major responsibility of the board, snr mgt and internal auditors?

Answer 4

Assessing risks and controls

Question 5

Risk & Control Assessment is made up of which categories

Answer 5

Audit Objective
Audit Program
Tools to conduct risk and control assessments

Question 6

Audit Objective of risk and control assessment

Answer 6

Determine whether an organisation risk assessment system allows the board and snr mgt to plan for and respond to existing risks and emerging risks

Question 7

Audit Program

Answer 7

1) Determine whether board and snr mgt involve outside risk consultants and internal control experts
2) Determine whether board and snr mgt discuss and evaluate risks and consider control issues during pre-planning stages of introducing new products and services
3) Determine adequacy of de-risking approaches taken
4) Determine whether a chief risk officer and staff computes VAR for each type of risks for each business division and for entire business organisation

Question 8

Value at risk (VAR)

Answer 8

Is the estimate of the maximum amount of loss that can occur in a given time period and at a given confidence level (95%).

Needs to be established for each risk type or risk category that is documented in risk descriptions and risk discussions.

Amount of VAR is the amount of risk capital needed to withstand a particular loss.

Monte Carlo method can be used to compute the VAR amount.

Risk appetite is directly related to VAR, meaning that the higher the risk appetite level, the larger the amount of VAR, implying more value is at risk.

Eg 95% confident that our org will have to incur $500k loss in next year.

Question 9

Back testing

Answer 9

Can help in comparing and reconciling the estimated VAR to the actual VAR to make future estimates better.

Question 10

Tools to conduct risk and control assessments

Answer 10

1) Risk Matrix
2) Risk Maps
3) Risk & Control map
4) Risk & Control matrix
5) Risk & Control Testing

Question 11

Risk Matrix

Answer 11

Is a tool for ranking and displaying risks with their maximum and minimum values for consequences (impacts) and likelihoods (probabilities)

A matrix expresses the same thing as the level of risk

Risk matrix = consequences (impacts) x Likelihoods (probabilities)