{"id":3746,"date":"2025-01-21T14:32:01","date_gmt":"2025-01-21T07:32:01","guid":{"rendered":"https:\/\/audithink.com\/?p=3746"},"modified":"2026-10-13T11:02:41","modified_gmt":"2026-10-13T04:02:41","slug":"risk-based-audit","status":"publish","type":"post","link":"https:\/\/audithink.com\/en\/blog\/risk-based-audit\/","title":{"rendered":"Know the concept of Risk Based Audit and its examples &amp; stages"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Risk based audit is an audit approach that uses the results of a risk assessment to decide which areas are audited first, how often, and how deeply. Without this approach, auditors' time is easily spent on low-risk areas while high-risk areas are missed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This article covers the definition, examples, stages, the basis in standards and regulations, and risk identification techniques in risk based auditing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is <em>Risk Based Audit<\/em>?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Risk based audit<\/em> audit is an audit process that focuses on how risks can affect the achievement of organizational goals.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this approach, the focus on risk means that the audit process must be able to identify, evaluate, and prioritize aspects that have a high risk to be improved.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In this way, resources can be allocated more efficiently to address the areas most vulnerable to failure or non-compliance, so that risks can be better managed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In a cycle-based approach, all areas are audited in turn regardless of their level of risk. In risk based audit, the audit plan and coverage are determined by the risk assessment. Compliance is still audited when the risk of non-compliance is significant or when regulations require it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This allows <a href=\"https:\/\/audithink.com\/en\/article\/what-is-auditor\/\"><strong>auditor<\/strong><\/a> to provide greater added value for the organization in achieving its goals.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Some basic terms according to the glossary of the Global Internal Audit Standards (GIAS) 2024: risk is the positive or negative effect of uncertainty on objectives; inherent risk is the risk that exists in the absence of management actions; residual risk is the portion of inherent risk that remains after management actions are implemented; and risk appetite is the types and amount of risk an organization is willing to accept.<\/p>\n\n\n\n<figure class=\"wp-block-table has-fixed-layout\"><table><thead><tr><th>Aspect<\/th><th>Cycle-based audit<\/th><th>Risk based audit<\/th><\/tr><\/thead><tbody><tr><td>Basis for choosing areas<\/td><td>All areas in turn<\/td><td>The results of the risk assessment<\/td><\/tr><tr><td>Frequency<\/td><td>The same for all areas<\/td><td>More frequent for high risks<\/td><\/tr><tr><td>Resource allocation<\/td><td>Even<\/td><td>Directed to significant areas<\/td><\/tr><tr><td>Compliance<\/td><td>Audited as part of the cycle<\/td><td>Audited when the risk is significant or required by regulation<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">What Are Examples of <em>Risk Based Audit<\/em>?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In risk-based auditing, the auditor uses this approach to prioritize resources in the areas with the greatest potential impact.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here are some examples of implementing risk-based audits:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Specific industries with high risk<\/strong>In the case of the banking industry, the risk of regulatory compliance (<em>compliance risk<\/em>) very high due to strict regulatory changes. Auditors focus on the area of compliance with financial regulations.<\/li>\n\n\n\n<li><strong>Business processes with high risk<\/strong>Abstract : in manufacturing companies, raw material procurement processes that depend on one main supplier have a high risk. Auditors focus on procurement-related controls to prevent operational disruption or potential fraud.<\/li>\n\n\n\n<li><strong>Financial Risk Assessment at Banks<\/strong>: For commercial banks, POJK 1\/POJK.03\/2019 Article 12 requires the annual audit plan to be prepared on the basis of a comprehensive risk assessment that covers, among other things, capital adequacy and liquidity adequacy.<\/li>\n\n\n\n<li><strong>Audit Sistem IT<\/strong>: In technology companies, auditors can focus on cybersecurity risks, such as vulnerability to hacking attacks, as these can have a major impact on the continuity of operations.<\/li>\n\n\n\n<li><strong>Environmental risk and sustainability<\/strong>: In companies engaged in the energy sector, auditors focus on environmental obligations, such as potential fines for pollution or non-compliance with carbon emission standards.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The following is an example of ranking audit areas. The figures are hypothetical for illustration, not a standard.<\/p>\n\n\n\n<figure class=\"wp-block-table has-fixed-layout\"><table><thead><tr><th>Audit area<\/th><th>Main risk<\/th><th>Impact (1 to 5)<\/th><th>Likelihood (1 to 5)<\/th><th>Control effectiveness<\/th><th>Priority<\/th><\/tr><\/thead><tbody><tr><td>Raw material procurement<\/td><td>Dependence on a single main supplier<\/td><td>4<\/td><td>4<\/td><td>Weak<\/td><td>High<\/td><\/tr><tr><td>Petty cash<\/td><td>Discrepancies and misuse of small funds<\/td><td>2<\/td><td>3<\/td><td>Good<\/td><td>Low<\/td><\/tr><tr><td>Financial system security<\/td><td>Unauthorized access<\/td><td>5<\/td><td>3<\/td><td>Currently<\/td><td>High<\/td><\/tr><tr><td>Payroll<\/td><td>Unauthorized payments<\/td><td>3<\/td><td>3<\/td><td>Good<\/td><td>Currently<\/td><\/tr><tr><td>Land reclamation<\/td><td>Fines and environmental obligations<\/td><td>4<\/td><td>3<\/td><td>Not yet tested<\/td><td>High<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Impact and likelihood are considered together with the control effectiveness already known. High-priority areas enter this year's plan and are audited more often, while low-priority areas are scheduled less often. This pattern is in line with GIAS Standard 9.4, which asks the chief audit executive (CAE) to consider the level of risk of each auditable unit relative to the known level of control effectiveness.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">See also:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/it-audit\/\">Get to know what an IT Audit is and its types, objectives, procedures, and examples<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What Are the Stages of <em>Risk Based Audit<\/em>?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Risk based audit uses a risk assessment to determine the areas and depth of the audit. Its results help give management and the board assurance that risks are managed within acceptable limits. The stages run at two levels, the organization level and the engagement level.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><svg viewbox=\"0 0 900 150\" role=\"img\" aria-label=\"The risk based audit flow from audit universe to follow-up\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:100%;height:auto;max-width:900px\" font-family=\"inherit\" font-size=\"15\"><defs><marker id=\"rba-ar\" markerwidth=\"10\" markerheight=\"10\" refx=\"8\" refy=\"5\" orient=\"auto\"><path d=\"M0,0 L10,5 L0,10 z\" fill=\"currentColor\"\/><\/marker><\/defs><g fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.6\"><rect x=\"10\" y=\"30\" width=\"150\" height=\"56\" rx=\"8\"\/><rect x=\"185\" y=\"30\" width=\"150\" height=\"56\" rx=\"8\"\/><rect x=\"360\" y=\"30\" width=\"150\" height=\"56\" rx=\"8\"\/><rect x=\"535\" y=\"30\" width=\"150\" height=\"56\" rx=\"8\"\/><rect x=\"710\" y=\"30\" width=\"170\" height=\"56\" rx=\"8\"\/><path d=\"M160,58 H183\" marker-end=\"url(#rba-ar)\"\/><path d=\"M335,58 H358\" marker-end=\"url(#rba-ar)\"\/><path d=\"M510,58 H533\" marker-end=\"url(#rba-ar)\"\/><path d=\"M685,58 H708\" marker-end=\"url(#rba-ar)\"\/><path d=\"M795,86 V120 H85 V88\" stroke-dasharray=\"5 4\" marker-end=\"url(#rba-ar)\"\/><\/g><g fill=\"currentColor\" text-anchor=\"middle\"><text x=\"85\" y=\"63\">1. Audit universe<\/text><text x=\"260\" y=\"63\">2. Risk assessment<\/text><text x=\"435\" y=\"63\">3. Audit plan<\/text><text x=\"610\" y=\"63\">4. Engagement<\/text><text x=\"795\" y=\"63\">5. Follow-up<\/text><text x=\"440\" y=\"142\">Update when risks change<\/text><\/g><\/svg><figcaption class=\"wp-element-caption\">The risk based audit flow from audit universe to follow-up<\/figcaption><\/figure>\n\n\n\n<figure class=\"wp-block-table has-fixed-layout\"><table><thead><tr><th>Level<\/th><th>Stage<\/th><th>Output or document<\/th><th>GIAS 2024 reference<\/th><\/tr><\/thead><tbody><tr><td>Organization<\/td><td>Understanding objectives, strategy, and governance, risk management, and control processes<\/td><td>Understanding of the organization<\/td><td>Standard 9.1<\/td><\/tr><tr><td>Organization<\/td><td>Building the audit universe, then identifying and assessing the risks of each unit<\/td><td>Audit universe and risk map<\/td><td>Standard 9.4<\/td><\/tr><tr><td>Organization<\/td><td>Preparing the risk-based audit plan and updating it when risks change<\/td><td>Annual audit plan and resource allocation<\/td><td>Standard 9.4<\/td><\/tr><tr><td>Engagement<\/td><td>Assessing engagement risks<\/td><td>Risk and control matrix<\/td><td>Standard 13.2<\/td><\/tr><tr><td>Engagement<\/td><td>Setting objectives, scope, criteria, and the work program<\/td><td>Audit work program<\/td><td>Standards 13.3 to 13.6<\/td><\/tr><tr><td>Engagement<\/td><td>Performing tests and evaluating findings<\/td><td>Working papers and findings<\/td><td>Principle 14<\/td><\/tr><tr><td>Engagement<\/td><td>Reporting results and monitoring follow-up<\/td><td>Report and action plans<\/td><td>Principle 15<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The following sequence summarizes the stages above in eight steps:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Understand the organization's objectives and processes: its strategy, objectives, and governance, risk management, and control processes.<\/li>\n\n\n\n<li>Identify risks: determine and record risks that can affect the achievement of objectives or the organization's operations.<\/li>\n\n\n\n<li>Assess risks: evaluate each risk based on its impact and likelihood, including the effectiveness of existing controls.<\/li>\n\n\n\n<li>Prepare the risk-based audit plan: draw up the annual audit plan, schedule, and resource needs based on risk ranking.<\/li>\n\n\n\n<li>Assess engagement risks and prepare the work program: for each engagement, understand the area audited, then set the objectives, scope, criteria, and work program.<\/li>\n\n\n\n<li>Testing: document review, interviews and surveys, data analysis, control evaluation, and compliance review.<\/li>\n\n\n\n<li>Reporting: prepare a report containing findings, risk assessments, compliance status, and recommendations or action plans.<\/li>\n\n\n\n<li>Follow-up and updating: monitor improvements, then update the risk assessment and audit plan when risks change.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">See also:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/audit-universe\/\">Know what the Audit Universe, benefits, procedures, and examples<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/risk-assessment\/\">Risk Assessment is: meaning, steps, Matrix, &amp; examples<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/internal-audit-work-program\/\">Audit Program (Internal Audit Work Program): Definition, Types, Examples, and How to Prepare One<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/corporate-internal-audit-finding-follow-up\/\">Audit Finding Follow-Up: Causes of Overlooked Issues and Their Solutions<\/a><\/li>\n<\/ul>\n\n\n\t\t<div data-elementor-type=\"section\" data-elementor-id=\"5427\" class=\"elementor elementor-5427\" data-elementor-post-type=\"elementor_library\">\n\t\t\t<div class=\"elementor-element elementor-element-c693698 e-flex e-con-boxed e-con e-parent\" data-id=\"c693698\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-f131bf4 cta-banner-article elementor-widget elementor-widget-image\" data-id=\"f131bf4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a href=\"https:\/\/audithink.com\/en\/demo\/\" data-at-cta=\"banner-artikel\">\n\t\t\t\t\t\t\t<img fetchpriority=\"high\" decoding=\"async\" width=\"2400\" height=\"800\" src=\"https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo.webp\" class=\"attachment-full size-full wp-image-5428\" alt=\"cta banner campaign\" srcset=\"https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo.webp 2400w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo-300x100.webp 300w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo-1024x341.webp 1024w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo-768x256.webp 768w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo-1536x512.webp 1536w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo-2048x683.webp 2048w, https:\/\/audithink.com\/wp-content\/uploads\/2026\/07\/audithink-banner-v3-photo-18x6.webp 18w\" sizes=\"(max-width: 2400px) 100vw, 2400px\" title=\"\">\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\n\n\n\n<h2 class=\"wp-block-heading\">What Are the Standards and Regulations Behind Risk Based Audit?<\/h2>\n\n\n\n<figure class=\"wp-block-table has-fixed-layout\"><table><thead><tr><th>Reference<\/th><th>Relevant content<\/th><th>Notes<\/th><\/tr><\/thead><tbody><tr><td>GIAS 2024 Standard 9.4 (Internal Audit Plan)<\/td><td>The chief audit executive must base the audit plan on a documented assessment of the organization's strategies, objectives, and risks. The assessment is performed at least annually, the plan must be dynamic, and the plan and its significant changes are approved by the board.<\/td><td>GIAS 2024 has been effective since 9 January 2025<\/td><\/tr><tr><td>GIAS 2024 Standard 9.4, considerations for implementation<\/td><td>An example approach: building an audit universe (business units, processes, programs, systems) and linking it to key risks. If the environment is dynamic, the plan may be updated every six months, quarterly, or even monthly. The audit function should independently validate the key risks.<\/td><td>Implementation guidance<\/td><\/tr><tr><td>GIAS 2024 Standard 13.2 (Engagement Risk Assessment)<\/td><td>In each engagement, auditors understand the activity under review, identify significant risks to its objectives, consider fraud risks, and prioritize the risks for review.<\/td><td>Engagement level<\/td><\/tr><tr><td>POJK 1\/POJK.03\/2019 Article 12<\/td><td>Commercial banks must have an annual audit plan prepared on the basis of a comprehensive risk assessment, covering at least governance, risk management, capital adequacy, liquidity adequacy, internal reporting, compliance, and finance.<\/td><td>Applies to commercial banks<\/td><\/tr><tr><td>POJK 56\/POJK.04\/2015 Article 7<\/td><td>The internal audit unit of issuers and public companies is tasked with preparing and carrying out the annual internal audit plan and testing and evaluating internal control and the risk management system.<\/td><td>Does not explicitly require risk based audit<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The IIA standards do not make risk based audit a separate obligation, but they require the audit plan to be built from a documented risk assessment. For internal auditors who follow GIAS, a risk-based approach is the basis for preparing the plan, not an optional extra. The validity of regulations can change, so check the latest text.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Risk management frameworks such as COSO ERM and ISO 31000 are references for how an organization manages risk. Internal auditors evaluate that process; they do not replace it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">References:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.theiia.org\/globalassets\/site\/standards\/globalinternalauditstandards_2024january9.pdf\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Global Internal Audit Standards 2024 (The IIA)<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/peraturan.bpk.go.id\/Download\/119492\/pojk%201%20-%202019.pdf\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">POJK 1\/POJK.03\/2019 on the Implementation of the Internal Audit Function at Commercial Banks<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/peraturan.bpk.go.id\/Download\/119697\/SALINAN-POJK%20%2056.%20Pembentukan%20dan%20Pedoman%20Penyusunan%20Piagam%20Unit%20Audit%20Internal.pdf\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">POJK 56\/POJK.04\/2015 on the Establishment and Guidelines for Preparing the Internal Audit Unit Charter<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">See also:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/coso-framework\/\">Implementation of the COSO Framework in Internal Audit Systems<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/iso-31000-risk-management\/\">Implementing ISO 31000: Risk Management Framework for enterprises<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/internal-audit-standards-in-indonesia\/\">Internal Audit Standards in Indonesia and Guidelines for Their Implementation<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What Are the Risk Identification Techniques in <em>Risk Based Audit<\/em>?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Risk identification techniques have a very important role in <em>risk based audit<\/em> because it is the first step that determines the focus and efficiency of the entire audit process.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Without this process, the auditor will not be able to determine the focus of an effective audit, thereby reducing the impact and relevance of the audit to the organization's risk management.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here are some of them:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>SWOT analysis<\/strong>: As a complementary technique, this analysis helps auditors map the organization's internal strengths and weaknesses, as well as outside opportunities and threats.<\/li>\n\n\n\n<li><strong>Scenario Analysis<\/strong>: The Auditor thinks about various situations that may occur in the future and assesses the risks that come with it.<\/li>\n\n\n\n<li><strong>Historical Analysis<\/strong>: Looking back at previous audit findings, incidents, and loss data helps auditors find recurring risk patterns.<\/li>\n\n\n\n<li><strong>Session <\/strong><strong><em>Brainstorming<\/em><\/strong>: Team discussions allow many new ideas to emerge, opening up the possibility of discovering risks that may have been missed.<\/li>\n\n\n\n<li><strong><em>Benchmarking<\/em><\/strong>: Comparing organizational processes with industry standards or best practices helps auditors identify gaps or deviations that are at risk.<\/li>\n\n\n\n<li><strong>Identifying risks with technology<\/strong>: Using advanced analytical tools and software helps auditors find patterns and risks faster through Big data Processing.<\/li>\n\n\n\n<li><strong>Risk Register<\/strong>: <em>Risk register<\/em> is an important document that contains all identified risks to monitor risks in a structured way and plan mitigation steps. Auditors need to independently validate the key risks in the register, and rely on management's information only when the risk management process is concluded to be effective.<\/li>\n\n\n\n<li><strong>Review of Existing Risk Assessments<\/strong>: Auditors review management's risk assessments and previous engagement working papers as a starting point, then update them when there are changes.<\/li>\n\n\n\n<li><strong>Interviews and Process Walkthroughs<\/strong>: Tracing the process flow together with the people who run it helps auditors understand how the process really works and where its risks are.<\/li>\n\n\n\n<li><strong>Risk and Control Matrix<\/strong>: A matrix that links objectives, risks, and controls helps auditors map the risks that need to be tested.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">See also:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/key-risk-indicator\/\">Key Risk Indicator: Purpose, Examples, and Differences from Key Performance Indicators<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">How Is Risk-Based Audit Implemented?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The implementation of risk-based auditing can improve the efficiency of auditing and Risk Management in organizations, although there are challenges to be overcome.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Advantages <em>Risk Based Audit<\/em><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">This approach focuses auditing on the areas with the highest risk, so that resources can be used more effectively.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Auditor does not need to check all aspects <a href=\"https:\/\/audithink.com\/en\/article\/operational-audit\/\">operations<\/a>, but rather simply prioritize parts that have the potential to cause major losses.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In addition, RBA helps make audits more relevant by highlighting the areas that most affect the achievement of objectives. Specific audit results make it easier for management to make decisions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Implementation Challenges<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">One of the main obstacles is the lack of complete and accurate data on risk and dependence on the quality of risk assessment. An incorrect assessment can direct the audit to less important areas.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Rapid changes in risk are also a challenge. Dynamic business environments, such as regulatory or technological changes, require flexibility and strong analytical skills to enable auditors to adjust audit plans promptly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Limited audit resources are also a challenge. That is why GIAS Standard 9.4 asks the chief audit executive to tell the board and senior management how resource limitations affect audit coverage, and why a high-risk area is left out of the plan.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How Do You Start Risk Based Auditing in Your Organization?<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Build an audit universe that lists the business units, processes, programs, and systems that can be audited.<\/li>\n\n\n\n<li>Set the risk assessment criteria, for example impact, likelihood, and control effectiveness.<\/li>\n\n\n\n<li>Rank the audit areas, then prepare the annual plan along with the resources needed.<\/li>\n\n\n\n<li>Schedule updates to the risk assessment, at least once a year and more often when the environment changes quickly.<\/li>\n\n\n\n<li>Document the results and monitor follow-up until completion.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">What Is the Difference Between Risk Based Audit, Audit Risk, and Risk Based Approach?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">These three terms are often confused. Audit risk in an external audit is the risk that the auditor expresses an inappropriate opinion on financial statements that contain a material misstatement. Risk based audit, by contrast, is a way of setting audit priorities based on the risks to the organization.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Risk based approach is a more general term for risk-based approaches in various fields, for example compliance, and is not covered in this article.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">See also:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/audit-risk\/\">Audit Risk: definition, types, examples, and how to determine<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/inherent-audit-risk\/\">Inherent risk in auditing: definition, examples and ways of measuring<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/control-risk-in-auditing\/\">Control Risk in Auditing: Definition, Examples, and How to Assess It<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/audit-assertions-and-risk-assessment\/\">The Relationship Between Audit Assertions and Risk Assessment<\/a><\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ About <em>Risk Based Audit<\/em><\/h2>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What is <em>risk based audit<\/em>?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\"><em>Risk based audit<\/em> is an audit process that focuses on how risks can affect the achievement of organizational goals. Auditors identify, evaluate, and prioritize high-risk aspects so audit resources are allocated to the most vulnerable areas.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What is the difference from traditional audits?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">Traditional audits generally audit all areas in turn, regardless of their level of risk. Risk based audit sets priorities and coverage based on a risk assessment. Compliance is still audited when the risk is significant or required by regulation.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What Are the Stages of Risk Based Audit?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">The stages run at two levels. At the organization level, auditors understand the organization's objectives and processes, identify and assess risks, then prepare the risk-based audit plan. At the engagement level, auditors assess engagement risks, prepare the work program, perform testing, report findings, and monitor follow-up.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>Which risk identification techniques are used?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">SWOT analysis, scenario analysis, historical analysis of previous audit findings, <em>brainstorming<\/em> sessions with the team, <em>benchmarking<\/em> against industry best practices, identification aided by analytics technology, and preparing a <em>risk register<\/em> to monitor risks in a structured way.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What are the advantages of applying risk-based audits?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">Audits focus on the highest-risk areas so resources are used more effectively, and auditors do not need to examine every operational aspect. The results are also more relevant and specific, which makes it easier for management to make decisions.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>Apa tantangan penerapan risk based audit?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">The challenges include a lack of complete and accurate risk data, dependence on the quality of the risk assessment (a wrong assessment can steer the audit toward less important areas), and fast-changing risks due to shifts in regulation and technology.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What are the standards behind risk based audit?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">For internal auditors, the basis is Global Internal Audit Standards (GIAS) 2024 Standard 9.4, which requires an audit plan based on a documented risk assessment, and Standard 13.2 for the risk assessment of each engagement. For commercial banks, POJK 1\/POJK.03\/2019 Article 12 also requires a risk-assessment-based audit plan.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>How often is a risk-based audit plan updated?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">According to GIAS 2024 Standard 9.4, the risk assessment that underpins the audit plan is performed at least once a year. If the organization's environment is dynamic, the plan may be updated every six months, quarterly, or even monthly.<\/p>\n<\/details>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary><strong>What is the difference between risk based audit and audit risk?<\/strong><\/summary>\n<p class=\"wp-block-paragraph\">Audit risk is an external audit concept, namely the risk that the auditor gives an inappropriate opinion on financial statements that contain a material misstatement. Risk based audit is an approach that uses the organization's risks to set audit priorities and coverage.<\/p>\n<\/details>\n\n\n\n<h2 class=\"wp-block-heading\">How Does Internal Audit Software Help Risk Based Auditing?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Audithink is internal audit management software that can be customized to your organization's methodology; it is not an audit performer. The risk assessment feature helps record and assess risks by area or process. The audit planning feature helps prepare schedules based on those assessments, and work program templates help standardize engagements. Notifications, follow-up monitoring, and automated reports help the team track recommendations through to completion. Audithink does not replace the auditor's role in assessing risk and making professional judgments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Schedule <a href=\"https:\/\/audithink.com\/en\/demo\/\"><strong>demo<\/strong><\/a> to see how it fits the risk based audit methodology in your organization.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Also read, the application of risk based audit and its standards:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/audithink.com\/en\/article\/implementing-risk-based-audit-in-state-owned-enterprises\/\" data-type=\"post\" data-id=\"6133\">A Guide to Implementing Risk-Based Audit in State-Owned and Regionally Owned Enterprises<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/audithink.com\/en\/article\/aligning-global-audit-standards\/\" data-type=\"post\" data-id=\"4780\">Aligning Global Audit Standards with Corporate GRC Programs<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Risk based audit directs audit resources to the riskiest areas so they are not wasted on less significant ones. Learn the concept, stages, and examples.<\/p>","protected":false},"author":12,"featured_media":3748,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":"","rank_math_title":"Risk Based Audit Adalah? Tahapan, Contoh, dan Standar IIA","rank_math_description":"Risk based audit adalah pendekatan audit yang memprioritaskan area paling berisiko. Pelajari tahapan, contoh, dan acuan Global Internal Audit Standards.","rank_math_canonical_url":"","rank_math_focus_keyword":"risk based audit","rank_math_facebook_title":"","rank_math_facebook_description":"","rank_math_twitter_title":"","rank_math_twitter_description":"","_yoast_wpseo_title":"","_yoast_wpseo_metadesc":"","_yoast_wpseo_canonical":"","_yoast_wpseo_focuskw":"","_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_opengraph-title":"","_yoast_wpseo_opengraph-description":"","rank_math_robots":[]},"categories":[15],"tags":[30],"class_list":["post-3746","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-kebijakan-audit"],"acf":[],"_links":{"self":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts\/3746","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/comments?post=3746"}],"version-history":[{"count":5,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts\/3746\/revisions"}],"predecessor-version":[{"id":7276,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/posts\/3746\/revisions\/7276"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/media\/3748"}],"wp:attachment":[{"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/media?parent=3746"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/categories?post=3746"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/audithink.com\/en\/wp-json\/wp\/v2\/tags?post=3746"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}