Risk is inherent in running any business — understanding those risks, and knowing how much risk to take, is often the difference between reward or failure. This white paper takes a historical look at how risk management has evolved over time to become risk governance.
How Organizations Are Positioning the Internal Audit Function to Support Their Approach to Risk Management
Risk is inherent in running any organization — understanding those risks, and knowing how much risk to take, is often the difference between reward and failure. The last few years have sharply intensified the focus of organizations on understanding their desired and actual risk profile and how they manage those risks. During this time, it has become clear that basic risk management alone may not be enough.
The concept of risk management is evolving into a more fully developed, integrated concept of risk governance, in which the board of directors, senior management, and the business units of an organization have distinctly defined roles in the overall approach to enterprise risk management (ERM).
ERM enables leaders to take a holistic view of risks, their uncertainties, and associated magnitude and likelihood, and design an appropriate operational response. This, then, enhances the capacity to build value.
Internal audit can help facilitate the ERM process. Since internal auditors will generally have an in-depth knowledge of the organization and the discipline to identify, evaluate, and report on risks and their consequences, the function can also be a key participant in identifying risks, evaluating the related controls, and monitoring risk mitigation activities.
The Role of Internal Audit in Risk Governance takes a historical look at how risk management has evolved over time to become risk governance. It includes tips on risk communication protocols and shares the four main reasons organizations are looking to outsourcing as an option for their internal audit function.