Photo by Sasun Bughdaryan on Unsplash
Deciding what to audit this year is often harder than auditing it. The list of units and processes keeps growing, while time and the number of auditors are limited. Risk-based auditing answers this problem with one principle: direct audit resources first to the areas with the highest risk.
Risk-based audit software is software that helps internal audit teams assess the risk of each unit or process, then uses the results to set audit priorities and plans. In Audithink, risk criteria are set to suit the organisation, the system calculates risk based on criteria weights, and the result becomes the basis for the annual audit plan.
This page explains the workflow, the Audithink features involved, what Audithink does not do, and the standards it refers to. To understand the basic concept first, read the article Know the concept of Risk Based Audit and its examples & stages.
What Is the Risk-Based Audit Workflow in Audithink?
The workflow follows the auditor's order of work, from risk assessment to follow-up monitoring.
- Set risk criteria. The organisation defines the relevant risk criteria and assigns a weight to each criterion.
- Assess risk per unit or process. Auditors assess the risk, then the system calculates the result based on the criteria weights.
- Build the annual audit plan. The plan is built from risk priorities, complete with the scope, timeframe, team members, and budget of each engagement.
- Turn it into audit programs. Work program templates can be reused and adapted for each engagement.
- Record findings and monitor follow-up. Findings and recommendations are discussed with the auditee through notices, then follow-up progress is monitored until completion.
- Report on realisation. Reports are generated automatically from the data already entered, and the dashboard shows audit plan realisation, the distribution of findings, and overdue follow-ups.
| Risk-based audit needs | Relevant Audithink feature | Reference article |
|---|---|---|
| Assessing risk per unit or process | Risk assessment | Risk assessment |
| Building the annual audit plan from risk priorities | Audit planning | Risk based audit |
| Standardising work programs across engagements | Work program templates | Internal audit work programs |
| Discussing findings and recommendations with the auditee | Notice | Audithink features |
| Monitoring follow-up of recommendations | Follow-up monitoring | Follow-up on findings |
| Reporting on audit plan realisation | Automatic reports and dashboards | Audithink features |
The audit plan and report formats your organisation requires can be confirmed during the demo.
What Is the Difference Between Risk Assessment for Audit and Enterprise Risk Management?
The two are often confused. Risk assessment for audit is carried out by the internal audit function to set examination priorities. Enterprise risk management is run by management to manage day-to-day business risk. This division of roles is in line with the Three Lines Model.
| Aspect | Risk assessment for audit | Enterprise risk management |
|---|---|---|
| Executor | Internal audit function | Management and the risk management function |
| Purpose | Determining which units or processes to audit first | Identifying, managing, and mitigating business risk |
| Main output | Risk assessment results and the annual audit plan | Risk register, mitigation plans, and risk monitoring |
| In Audithink | Available: risk assessment and audit planning | Not provided at this time: risk register, mitigation tracking, and key risk indicators (KRIs) |
What Does Audithink Not Do?
To keep expectations clear: Audithink is not a replacement for enterprise risk management software. It has no risk register, mitigation tracking, or key risk indicators (KRIs). Risk assessment in Audithink is used to set audit priorities, not to manage day-to-day business risk.
This page also does not claim direct integration with other risk management systems, so ask about integration needs during the demo. Needs beyond the existing features can be discussed with a Product Expert.
What Are the Standards and Regulations Behind Risk-Based Auditing?
- GIAS 2024 Standard 9.4 (Internal Audit Plan) requires the audit plan to be built on a documented assessment of the organisation's strategy, objectives, and risks, with the risk assessment performed at least once a year. Covered in the articles risk based audit and GIAS 2024 for university SPIs.
- POJK 1/POJK.03/2019 Article 12 requires the annual audit plan of commercial banks to be based on a risk assessment. The banking context is covered in Audithink for banking.
- Permendagri 4/2026 Article 4 and Article 6 paragraph (3) require inspectorate oversight and the PKPT to be built on priorities and risk. Covered in the article Inspectorate PKPT.
Audithink helps document the risk assessment and audit plan that these references call for. Final conformity still depends on the criteria set and the process your organisation runs.
Who Is Risk-Based Audit Software Suitable For?
This approach is most useful for internal audit teams whose units or processes outnumber their yearly audit capacity, and who need to explain how audit objects were chosen to management, the audit committee, or regulators. Sector-specific context is available in solutions by industry.
Which Articles Are Worth Reading Next?
- Know the concept of Risk Based Audit and its examples & stages
- A Guide to Implementing Risk-Based Audit in State-Owned and Regionally Owned Enterprises
- Risk Assessment is: meaning, steps, Matrix, & examples
- Risk management Audit: a comprehensive guide for companies
- Implementing ISO 31000: Risk Management Framework for enterprises
FAQ About Risk-Based Audit Software
What is risk-based audit software?
Software that helps internal audit teams assess the risk of each unit or process, then uses the results to set audit priorities and plans. The aim is to direct limited audit resources first to high-risk areas.
Can Audithink calculate risk scores?
Yes. Risk criteria can be set to suit the organisation, and the system calculates risk based on the weight of those criteria. The result becomes the basis for the audit plan.
Does Audithink have a risk register?
No. Audithink does not provide a risk register, mitigation tracking, or key risk indicators (KRIs). Risk assessment in Audithink is dedicated to setting audit priorities.
Is Audithink a replacement for enterprise risk management (ERM) software?
No. Enterprise risk management is run by management to manage business risk, while Audithink is used by the internal audit function to plan, carry out, report, and monitor audits.
Can the annual audit plan be built from risk assessment results?
Yes. The audit planning feature is used to build the annual plan based on risk priorities, complete with scope, timeframe, team members, and budget. The plan document format you need can be discussed during the demo.
Can the risk criteria be adapted to our industry?
Risk criteria can be set to suit the organisation. Which criteria suit your industry can be discussed with a Product Expert during the demo.
Conclusion
Risk-based auditing works when risk assessment, audit plan, work programs, and follow-up are connected. With the workflow recorded in one system, the audit team can explain why an object was chosen and how far the plan has been realised.
Want to see the workflow using your organisation's risk criteria? Schedule an Audithink demo. Feature details are available in Audithink features, and package details are on the Audithink pricing page.
