Reducing the uncertainty of risk in audit

Black Swan risks

A Black Swan risk is a truly extraordinary event. It is a high significance, high impact, low probability event, such as a global pandemic, terrorism, political instability, disruptive technology, or natural disasters. It could also be the complete failure of technology that puts an organization out of business for an extended period, not just an hour or two as systems go down. Are auditors adequately taking Black Swan events into account? Coming out of the pandemic, it does make sense to spend a bit more time focused on your business risks and how auditors should proactively plan for potential Black Swan events.

Prospective risks

Prospective risks are potential risks down the road, like climate change and rising sea levels. These risks may not be relevant right now, but there can be red flags or observable signs that risk is coming, so auditors need to have prospective risks on their radar.

Integrity of management

Auditors need to consider more risk than ever before in their audit role. In our more complex audit environments, it’s critical to take the integrity of management into account. This includes senior management, mid-level managers, and supervisors trying to meet their goals for the year. Is it possible that management’s integrity level could drop off because people are under intense pressure? This is something that auditors should be aware of.

Reliability of accounting systems and information

What if the reliability of accounting systems or information falters? What if competitive pressures, cashflow pressures, or growth pressures kept your systems from being properly maintained? While auditors may think the likelihood of this happening is low, the risk remains and is worth consideration.

Risk and the circle of trust

There are three sources of risk around what I call the “circle of trust.” Visualize the circle of trust as your entire organization’s operation. Looking from a distance, we can see that there are three positions on the circle.

Managing risks – both known and unknown

As our business environment grows more complex, auditors must anticipate new levels and varieties of risk. While these risks can be unpredictable, there are measures every auditor can take to help management mitigate their impact.

Existing risks

Existing risks, which are the risks auditors know about today, can be broken down into two tiers. The first tier includes the finance, compliance, reputation, technology, and fraud risks. These are the risks that auditors commonly perform a risk assessment on, whether annually, every six months, or even project by project. But it may be helpful for auditors to expand their thinking and go a little wider to include the Tier 2 risks, such as operations, supply chain, infrastructure, knowledge, and competition, into their risk assessments.

First, there are the people located outside the circle of trust, such as the public, our customers and clients, the students in our schools and taxpayers our government serves. The organization interacts with people in this first position, but we build in access and transaction controls to limit their access to our systems. This group makes up the outside risk.

The second position on the circle of trust is one foot in and one foot out. This group includes contractors and consultants, business partners, and recurring vendors – all of those people and organizations that are allowed into your organization only halfway. You let them into your circle of trust with one foot while remembering that they have their own business needs and objectives and are trying to generate their own profit. And sometimes, their fiduciary responsibility to serve you may conflict with their desire to maximize their profits or return on investment.

The third risk is made up of the people inside the circle of trust – the employees. It might be surprising, but they bring the highest level of risk to your organization. Why? Your internal employees are the controls. Management builds protective controls primarily against outside risk or those who we only let in halfway. These people aren’t allowed to go too deep into our systems, unlike the employees already inside the circle of trust.

Now that you better understand what is intended by “business risk” as a foundation for meaningful audit action, we’ll take a closer look at how the tools for risk tolerance measurement, including risk matrices, can help and hinder the audit function. Click here for part two.