Magnificent
State-owned and regionally owned enterprises face a range of risks across operations, finance, public service, and asset management. Oversight needs to be directed toward the areas that carry a higher level of risk.
Risk-Based Audit in state-owned and regionally owned enterprises helps auditors set examination priorities based on the risks that may affect the achievement of organizational objectives. This approach makes audit planning more focused.
This article covers how Risk-Based Audit is applied in state-owned and regionally owned enterprises, from risk mapping and audit program design through to monitoring findings.
What Is It Risk-Based Audit in the Public Sector?
Risk-Based Audit is an audit approach that uses risk assessment as the basis for determining the priority, scope, and frequency of examinations.
In state-owned and regionally owned enterprises, this approach helps auditors concentrate resources on the processes that carry significant risk to organizational performance and governance.
Applying Risk-Based Audit in state-owned and regionally owned enterprises also helps connect oversight activity to organizational objectives. Auditors can then offer recommendations that are more relevant to the risks identified.
Difference of Risk-Based Internal Audit (RBIA) and Traditional Compliance Audit
Risk-Based Internal Audit (RBIA) prioritizes examinations by level of risk. Auditors weigh both the likelihood of a risk and its impact on the achievement of organizational objectives.
Meanwhile, a traditional compliance audit focuses more on whether activities conform to the applicable regulations, policies, procedures, or standards.
The two can still be used side by side. Compliance testing can form part of a risk-based approach whenever non-compliance carries a significant impact.
The Framework: SPIP and GCG Principles Working Together
Implementation of Risk-Based Audit can be aligned with the internal control system and the principles of Good Corporate Governance (GCG).
SPIP helps an organization manage internal control systematically, while GCG emphasizes governance that is transparent, accountable, responsible, independent, and fair.
Bringing the two together keeps oversight from being oriented toward compliance alone. Auditors can also assess how effective control and risk management are through Risk-Based Audit in state-owned and regionally owned enterprises.
SPIP Audits in Government Agencies and GCG Implementation in State-Owned Enterprises
SPIP is the internal control framework used in the administration of government. How it is applied serves as an important reference for understanding control and risk management in public sector organizations.
In state-owned enterprises, GCG implementation has its own characteristics and requirements. Internal oversight needs to account for the governance structure, the business processes, and the regulations that apply to the company.
A risk-based approach helps connect risk assessment to the oversight agenda. Areas carrying higher risk can be given greater examination priority.
Implementation Stages of Risk-Based Audit in State-Owned and Regionally Owned Enterprises
Implementation of Risk-Based Audit begins with understanding organizational objectives and identifying the risks that could stand in the way of achieving them.
Auditors then assess those risks to set examination priorities. The results of that assessment become the basis for the audit plan and work program.
The stages that follow cover carrying out the examination, drafting findings, issuing recommendations, and monitoring follow-up. The whole Risk-Based Audit process in state-owned and regionally owned enterprises needs to be documented consistently.
Setting the Risk Profile and Risk Matrix Before an Audit
A risk profile gives an overview of the various risks an organization faces. Auditors can weigh how likely a risk is to occur and how large its impact on organizational objectives would be.
The assessment results can be laid out in a risk matrix to group them by priority level. Areas with high risk can then be treated as priority examination objects.
A risk matrix also helps auditors set the focus and resources of an examination. The assessment needs updating whenever business processes, regulations, or organizational conditions change.
Drafting the PKAT and Monitoring Findings
Risk assessment results can serve as one basis for drafting the Annual Audit Work Program (PKAT). That program covers the audit objects, scope, schedule, and resources.
Once an audit is complete, every finding needs to be recorded and its follow-up tracked. Monitoring helps ensure recommendations receive a response in line with the targets that were set.
Follow-up status can be updated based on the action taken and the evidence of completion. That information helps management see how improvements are progressing in a more structured way.
Roles Internal Audit Software in Making the SPI More Efficient
Managing audits manually can take a great deal of time, particularly when the SPI is handling many examination objects, documents, findings, and recommendations.
Internal audit software helps the SPI manage the Risk-Based Audit process in state-owned and regionally owned enterprises within a single system. Planning, documentation, findings, recommendations, and follow-up can all be tracked in a more structured way.
The system can also surface audit and risk status through a dashboard. That data makes it easier for auditors and management to keep track of oversight activity.
Steps for Transitioning to Risk-Based Auditing
Magnificent
The transition to Risk-Based Audit in state-owned and regionally owned enterprises needs to happen gradually, taking into account organizational readiness, resources, data, and the audit methodology in use.
Some of the steps that can be taken include:
- Understand the organizational objectives — Identify the strategic targets and the core processes that support achieving them.
- Map the risks — Identify risks by process, work unit, and organizational activity.
- Assess the level of risk — Use likelihood and impact parameters to set priorities.
- Adjust the audit plan — Prioritize examination objects based on the results of the risk assessment.
- Document the methodology — Define the procedures and criteria used in carrying out the audit.
- Monitor examination results — Evaluate findings and follow-up to see how effective the improvements have been.
- Carry out periodic evaluations — Update the risk profile and audit plan whenever organizational conditions change.
FAQ
What does it mean by Risk-Based Audit?
Risk-Based Audit is an audit approach that uses the level of risk as the basis for determining the priority, scope, and resources of an examination.
Why do state-owned and regionally owned enterprises need to adopt Risk-Based Audit?
This approach helps state-owned and regionally owned enterprises prioritize areas that carry significant risk. Oversight resources can be directed toward the activities most likely to affect organizational objectives.
How is SPIP related to Risk-Based Audit?
SPIP provides an internal control framework that helps organizations identify and manage risk. That information can then support risk-based audit planning.
What are the benefits of a internal audit software for the SPI?
Internal audit software helps the SPI manage planning, documentation, findings, recommendations, and follow-up in an integrated way within a single system.
Is Risk-Based Audit focused only on financial risk?
No. Risk-Based Audit can cover operational, compliance, information technology, reputational, and strategic risk, along with any other risk relevant to the organizational objectives.
How do you begin implementing Risk-Based Audit?
An organization can start by understanding its business objectives, mapping risks, setting priorities, adjusting the audit plan, and building a mechanism for continuous monitoring.
Conclusion
Risk-based oversight calls for a structured process, accurate data, and consistent monitoring. Going digital helps the SPI manage every Risk-Based Audit activity in state-owned and regionally owned enterprises in a more integrated way.
With Audithink, the audit process can be managed on a single platform — from risk-based planning and carrying out the examination to documenting findings and monitoring follow-up.
Build an oversight process that is more transparent, more measurable, and better aligned with the governance needs of state-owned and regionally owned enterprises, together with Audithink.
