Demystifying the concept of risk-based auditing, back to basics

 

Risk has always been at the core of internal auditing, serving as an essential element for defining priorities, evaluating controls, and identifying opportunities for improvement. Risk-based auditing is not an alternative approach or a passing trend; rather, it is the correct and structured way to conduct audits effectively and in alignment with corporate governance. Below, we explore three fundamental aspects that highlight the importance of risk in auditing.

1. Corporate Risk as a Driver for the Annual Audit Plan

Internal auditing must be aligned with the organization's strategic objectives and corporate risks. The development of the Annual Audit Plan should consider the identified risks and prioritize critical areas that could impact business continuity and success.

The Global Internal Auditing Standards reinforce this approach:

• Standard 9.4, under Principle 9, states that the head of audit must develop an audit plan based on a documented assessment of the organization's strategies, objectives, and risks.
• Standard 9.1 requires the audit manager to understand the organization's governance, risk management, operational, and control processes.

By following this structured approach, the audit function ensures that efforts are focused on evaluating high-risk areas, generating real impact, and contributing to a more efficient and secure management process.

2. Evaluating the Effectiveness of Risk Management

Internal auditing plays a crucial role in assessing the effectiveness of risk management. The primary objective is to verify whether the organization's processes and controls are sufficient to keep risks within acceptable levels. To achieve this, auditors should:

• Assess whether the inherent risks in the audited processes have been correctly identified.
• Examine the management of IT risks, ensuring information security and system resilience.
• Evaluate integrity and legal compliance risks, ensuring that the organization adheres to its ethical values, laws, and applicable regulations.
• Analyze whether the established controls are sufficient and effective in mitigating risk factors and keeping them within acceptable limits.
• Recommend improvements to strengthen risk management and enhance process efficiency.

If auditing identifies gaps in risk management, these represent potential vulnerabilities that may compromise the organization's objectives and should be addressed as soon as possible. The same applies to opportunities for improvement or refinements that can enhance operational efficiency.

3. Considering the Risk of Auditing

Beyond evaluating organizational risks, internal auditing must also consider audit risk, which refers to the possibility that the applied auditing procedures and techniques are insufficient to detect failures, non-compliance, or significant events. This risk can be minimized through:

• Proper selection of tests and sampling methods.
• Application of appropriate techniques for data and evidence analysis.
• Use of analytical tools to identify patterns and anomalies.

Ensuring that auditing is rigorously planned and executed using sound methodologies strengthens its credibility and enhances the reliability of findings and recommendations.

Final Reflections

Risk-based auditing is not an option; it is the correct way to ensure that internal auditing delivers real value to the organization. Risk guides planning, directs the assessment of control effectiveness, and demands that auditors remain aware of the limitations of their own analyses. By following this approach, internal auditing strengthens governance and helps the organization become more resilient, transparent, and prepared for future challenges.

Questions for Reflection:

1. Is your organization’s annual audit plan aligned with key strategic risks?
2. Is internal auditing evaluating whether risk management for the audited entity is effective and sufficient to keep inherent, IT, integrity, and legal compliance risks at acceptable levels?
3. How does your audit team assess and mitigate audit risk to ensure reliable results? Are detection risks being considered in the audit planning process?

Reflect on these points and consider how you can contribute to the evolution of internal auditing, ensuring it adds even more value to the organization!

Be happy!

Governance Without Culture Is Just a Concept; With Culture, It Becomes a Transformative Force!

 

Corporate governance, when reduced to rules and bureaucratic processes, is nothing more than a set of cold, disconnected guidelines. Without culture, the essence of what truly sustains ethics, transparency, and excellence in management is lost. Governance is not about rules, it is about behavior. And what shapes behavior? Culture.

If we want governance to go beyond theory and become a transformative force, we must embed it into the organization’s DNA, ensuring that its principles are naturally incorporated into daily decisions and conduct. Without this cultural foundation, governance remains fragile, superficial, and, in many cases, ineffective.

Governance Without Culture: A Structure Without a Soul

Many companies implement governance policies believing that simply adopting codes of conduct, audits, and controls will be enough to ensure integrity and efficiency. However, without a culture that supports these principles, such initiatives become mere formalities—easily bypassed or neglected when pressures and challenges arise.

Culture is what happens when no one is watching. It determines whether professionals follow the rules because they believe in them or are merely out of obligation. In an organization without a governance culture, processes exist but are not lived; guidelines are written but not respected.

When Culture Strengthens Governance

Governance gains strength when it is supported by a solid organizational culture. And this culture is built through examples, consistency, and genuine commitment from leadership. A company that wants to solidify its governance must ensure that its values are not just communicated but practiced.

Organizations with a strong governance culture have teams that understand that best practices are not burdens but foundations for sustainable growth. When this happens, controls are no longer seen as bureaucracy but as tools for protection and excellence.

From Concept to Real Impact

Organizational culture must be the foundation upon which governance is built. To achieve this, some key pillars are essential:

1. Exemplary Leadership – A flawless code of ethics is meaningless if leadership does not practice it. Governance starts at the top. Leaders must embody the values they preach.
2. Alignment Between Speech and Action – Governance cannot be a set of rules disconnected from the company’s reality. It must be integrated into the organization’s identity and purpose.
3. Engagement at All Levels – Effective governance is not just the responsibility of compliance officers or senior management. Every employee must understand their role in building an ethical and sustainable environment.
4. Continuous Education – Culture is not imposed; it is built. This construction happens through training, dialogue, and experiences that reinforce the importance of governance in daily operations.

When governance is anchored in a strong culture, it becomes a natural part of the company. It does not need to be enforced because it is understood, valued, and lived by everyone. Governance without culture is an empty theory; with culture, it is the driving force that propels organizations toward excellence.

 

Be Happy

Courage: The Foundation of Objectivity in Auditing – Are You Prepared?

 Auditing is an essential pillar of corporate governance, requiring professionals to commit fully to objectivity. Objectivity represents the auditor's independence in expressing their opinion without being influenced by external forces or personal conflicts. However, this objectivity cannot be sustained without a fundamental component: courage. When conducting their work, auditors must be prepared to face challenges, resist external pressures, and communicate their conclusions with unwavering ethics and transparency.

Courage and Independence: Inseparable in Auditing

An auditor’s independence goes beyond rules and regulations. It manifests in a resolute stance against attempts at influence and manipulation. In many instances, auditors encounter conflicting interests that seek to mitigate or even conceal critical information. In this scenario, courage becomes the anchor that ensures a rigorous and impartial assessment, protecting stakeholders and safeguarding the integrity of financial reports.

According to Domain II of the Global Auditing Standards, objectivity and courage are fundamental ethical principles for auditors. This domain establishes that auditors must maintain independent thinking and demonstrate resilience in the face of challenges that could compromise their professional integrity. Thus, courage becomes an essential element in ensuring that professional judgment is exercised freely and impartially.

Facing Pressures and Ethical Dilemmas

Internal and external pressures can arise from various directions, from managers attempting to downplay irregularities to clients seeking to influence opinions. Without the necessary courage to resist these pressures, audit objectivity is undermined. Therefore, auditors must align their ethical stance with emotional resilience, ensuring that their work remains uncompromised by adverse circumstances.

Transparent Communication: A Reflection of Courage

Courage is not limited to resisting pressures; it also manifests in the clarity and firmness with which auditors communicate their findings. Audit reports often contain sensitive information that may be uncomfortable for those involved. However, truth and transparency must always prevail, regardless of potential retaliation or dissatisfaction from the audited parties.

Building a Culture of Courage in Auditing

To strengthen objectivity in auditing, organizations must foster a culture of courage. Continuous training, institutional support, and guidelines that protect auditors from retaliation are fundamental elements of this process. Furthermore, audit leadership must set an example, demonstrating that ethics and truth are non-negotiable values.

Final Reflection

Complete objectivity in auditing can only exist when accompanied by courage. The auditor who stands firm in their ethical and professional principles significantly contributes to the reliability and transparency of governance processes, even if this stance may cost them adversaries or even their job.

Therefore, it is important for you to reflect: How is your objectivity? How do you escalate your findings or opinions? Are you prepared to face the challenges that auditing imposes and maintain your unwavering integrity?

Remember: ethics and truth are non-negotiable values.

Be happy!

 

Professional Diligence and Integrity: Lessons from the Wells Fargo Case for Risk Managers and Internal Auditors

 

The recent decision by the Office of the Comptroller of the Currency (OCC) against former Wells Fargo executives underscores the importance of professional diligence and integrity in risk management and internal auditing. This case highlights how failures in monitoring improper practices can lead to severe penalties, impacting both the company and its executives.

The OCC investigation revealed that Claudia Anderson, who served as the Community Bank Group Risk Officer, failed to adequately challenge the bank’s incentive program, neglected to implement effective controls to mitigate the risks of improper sales practices, and did not escalate known risks. Additionally, she was found to have provided false or misleading information to regulators during 2015 examinations. Former internal auditors David Julian, Chief Auditor, and Paul McLinko, Executive Audit Director, also failed to design effective audits to detect and document irregularities and did not properly escalate issues. In McLinko’s case, there was an additional concern regarding his compromised professional independence due to his close relationship with the bank’s retail division.

To prevent such scenarios, risk managers and internal auditors must operate with technical rigor, independence, and integrity, ensuring that internal controls are effective, and that risk oversight and escalation mechanisms function appropriately. Professionals in these areas need the courage to challenge policies and practices that could compromise governance and expose the organization to financial, regulatory, and reputational risks. Furthermore, it is crucial that they are embedded in a corporate culture that prioritizes transparency and compliance, thereby reducing their own exposure to potential penalties.

The Wells Fargo case serves as a critical warning: governance failures and oversight negligence can lead to severe legal and reputational consequences. For professionals in risk management and internal auditing, the lesson is clear— 
complacency and negligence are not options. A proactive and vigilant stance, grounded in best governance practices, is essential to ensuring that business decisions are made with ethics and responsibility.

Questions for Reflection:

1. How can corporate governance strengthen the independence and effectiveness of risk managers and internal auditors?
2. In what ways can companies foster a culture of transparency and compliance to mitigate fraud and irregularities?
3. What challenges do audit and risk professionals face when attempting to escalate critical issues within an organization?
4. How can companies ensure that incentive programs do not pose risks to organizational integrity?
5. What steps can professionals take to develop a more critical and proactive approach to risk identification and mitigation?

In future articles, I will explore these questions in greater depth. For now, I leave you with this thought:

Are you comfortable with how you are currently managing risks or conducting audits? Do you feel supported in questioning company practices that could pose governance, integrity, or reputational risks?

Be Happy!

The Importance of knowing How to Use Performance and Risk Indicators

By Eduardo Pardini

The success of an organization is not a matter of chance; it results from a well-structured set of practices that ensures its sustainability and growth over time. Among these practices, effective corporate risk management stands out as a critical component. However, for this management to be truly efficient, it is essential to have a monitoring system based on well-defined indicators.

Although much has been said about the importance of KPIs (Key Performance Indicators) and KRIs (Key Risk Indicators), significant doubts remain about when and how to use them effectively. This confusion is understandable, as both types of indicators have different yet complementary purposes:

• KPIs: Performance indicators that measure progress toward the organization's operational or strategic objectives. These measure the past, the results achieved, or risks that have already materialized. They are reactive, as management acts based on them to redirect activities and/or address the measured risk factor.
• Example: The sales conversion rate is a KPI used to measure the efficiency of a sales team in turning opportunities into actual clients.
• Another Example: The percentage of interest paid due to late payments to suppliers compared to the estimated residual risk and/or the acceptable risk level defined by the organization's risk appetite.
  
• KRIs: Risk indicators that provide early warnings of potential threats that could adversely impact the achievement of objectives. These are proactive indicators, anticipating future risks before they materialize.
• Example: An increase in household debt is a KRI indicating a potential risk of reduced planned sales levels.
• Another Example: Possible pressure on production costs due to a drought in the commodity-producing region, impacting the final product price.

Clearly distinguishing when and how to use these tools is crucial for ensuring that the organization has a holistic view of both its performance and the risks it faces.

The Strategic Role of Indicators

Simply implementing indicators is not enough; they need to be strategically selected and monitored. This means that each indicator must align with the organization's operational reality and strategic planning. Intelligent use of these tools is what differentiates prepared and insightful organizations from those caught off guard by unexpected risks or unattainable goals.

By monitoring KPIs, an organization can assess whether its goals are being achieved and identify opportunities for improvement. On the other hand, KRIs help anticipate and mitigate threats before they materialize, safeguarding the results already achieved.

Sustainable and Lasting Success

When properly applied, the combination of KPIs and KRIs is not merely a recommended practice; it is an indispensable condition for ensuring the sustainable success and longevity of an organization. These indicators enable companies not only to monitor their operations but also to act proactively in response to risks and opportunities.

Thus, by adopting an indicator-based approach, organizations strengthen their capacity for anticipation, enhance their resilience, and achieve consistent results over time.

Final Reflection

I invite you to reflect: Is your organization using KPIs and KRIs in an integrated and strategic manner? If not, it might be time to reassess your monitoring processes and tools. After all, the future belongs to companies that know where they are and where they are going—without losing sight of the risks along the way.