Teory and practice in internal audit

Abstract

Based on the results of the risk assessment, the internal audit activity should evaluate the adequacy and effectiveness of controls encompassing the organization’s governance, operations, and information systems. When planning the engagement, the internal auditor should identify and assess risks relevant to the activity under review. The engagement objectives should reflect the results of the risk assessment. Internal auditors can add value by: implementing a risk-based approach to planning and executing the internal audit process; ensuring that internal auditing’s resources are directed at those areas most important to the organization; challenging the basis of management’s risk assessment and evaluating the adequacy and effectiveness of risk treatment strategies; defining risk tolerances where none have been identified, based on internal auditing's experience, judgment, and consultation with management.