Risk Based Internal Auditing (RBIA)

• Registration Process: 8:30 AM - 9:00 AM
• Session Start: 9:00 AM
• What is Risk Based Internal Auditing?
• An introduction to Risk Based Internal Auditing
• Traditional Approach versus Risk Based internal approach
• Stages of Risk Based Internal Auditing
• Measuring the effectiveness of Risk Based Internal Auditing
• Risk Based Internal Auditing – Background
• Rationale behind Risk Based Internal Auditing
• Internal Audit – Definitions, Objectives & Scope
• The “Expectations Gap”
• The RISK BASED Internal Audit
• Comparison to the traditional approach
• Risk Management Understanding Risk
• The meaning of risk
• The attributes of risk – Likelihood & Consequence
• The Risk Heat Map
• Audit risk
• Business risks – classification, internal & external, controllable & non-controllable
• The COSO risk management framework
• Understanding COSO
• COSO — An Integrated Risk Management Framework
• The COSO ERM Framework
• COSO in Finer Detail
• Updates to COSO
• Basic concepts of risk management
• Risk capacity, risk appetite, risk response
• Inherent & residual risk
• Entity risk assessment & Business process risk assessment
• Significant risk
• Risk register
• ERM – Enterprise Wide Risk Management
• ERM and the Board of Directors
• What is covered under ERM
• Risk Maturity
• What is risk maturity
• Why it is important
• Risk maturity levels
• Scorecard for assessing risk maturity
• Analyzing the risk maturity results
• Using a Risk Based Internal Audit (RBIA) Methodology
• Audit is of management of risks and not of risk
• Key reporting areas in the management of risks
• Documenting Board assurance requirements and risk appetite
• Audit strategy & risk maturity
• Selecting individual risks to audit
• Frequency of coverage
• Including the Risks into an Audit Assignment
• Importance of selecting the right auditable unit

• Stages of RBIA
• Assessing risk maturity
• Preparing the audit plan
• Conducting the assurance audit
• Reporting to the appropriate level
• Model Process for Assessing & Evaluating Risks
• Risk assessment steps
• Risk assessment tools
• Risk identification
• Business Activities that are Sources of Risk
• Operational Risk and its categories
• Risk identification methods
• Industry risk models
• Choosing which methods to use
• Typical risk areas
• Risk estimation (Risk measurement/ Risk scoring)
• Risk evaluation
• Risk Heat map & Actions Needed
• Using risk scores
• Risk Assessment Tools
• Market survey
• Dependency modeling
• SWOT analyses
• Event tree analysis
• BPEST (Business, Political, Economical, Social & Technological)
• Fault tree analysis (Root Cause Analysis)
• FEMA (Failure Mode and Effect Analysis)
• Internal Audit Process

In this section the instructor will cover the complete Internal Audit Process through with the RBIA methodology is carried out in a consistent manner. This covers the need for the Internal Auditor to become acquainted with the business and the industry allowing him to assess the risk maturity which determines his/her ability to provide the PBIA assurance and to review the risk assessment done by management and the her/his conclusion whether this risk register may be relied upon.

The process covered includes;

• Strategic analysis
• Enterprise risk assessment
• Internal Audit Plan development
• What Risks to Audit – An Alternative Approach
• Internal Audit execution
• The Process Risk Matrix
• Reporting
• Issue Resolution tracking
• Case Study - How the RBIA methodology is applied.

This is an illustrative case study showing how the RBIA methodology is applied in a real world environment.

• Comparing the Two Methodologies

The speaker will compare RBIA methodology to the regular audit methodology. These methodologies will be examine in terms of;

• Managing risk
• Setting responsibility for risk management, and
• Usefulness to the Board of Directors
• Risk Registers

The speaker will examine and discuss examples of the RBIA documentation form the case study including;

• Risk Register,
• Audit Procedures and
• Transaction Files.
• Closing Discussion - Difficulties facing the Internal Auditor

The instructor will examine and discuss some of the pitfalls that the Internal Auditor may face in his/her assignment and some potential solutions.

Stanley Epstein has had extensive experience in banking and IT specifically the operations, payments, RTGS and the operational risk aspects of banking in the UK, Europe, the USA, Australia and Southern Africa. His bank-operations, payments systems, operational risk and clearing house experience is wide ranging and includes working closely with organisations such as UNCITRAL, Deutsche Bank and CHIPS in New York; APACS, British Bankers Association, CLS and Barclays Bank in London; Crédit Agricole in France; UBS and Credit Suisse in Switzerland, the central bank in the Netherlands; Alpha Bank in Greece; the central bank in Romania; the central bank in Kazakhstan; Bank Leumi and the central bank in Israel; the Standard Bank, Clearing Bankers Association; Bankserv and the central bank in South Africa and ANZ and Commonwealth Bank in Australia.

Commencing his career at the Standard Bank of South Africa he gained a thorough grounding in all aspects of banking ranging from the bank’s branch system, back-office payments processing. He was also closely involved in the development of electronic banking at the Standard Bank. At a banking industry level he was involved in the creation and development of STRATE (Central Securities Depository in South Africa dealing with the dematerialization, clearing and settlement of all financial instruments in that country. He also served as Vice Chairman of the South African Clearing Bankers Association’s ERAG Group (an interbank payments/operations risk initiative established to identify & eliminate operational, legal and other risks in electronic payments) and later as Chairman of the Payments Association of South Africa Operational Risk Committee. On leaving South Africa he joined Fundtech Corporation, a leading provider of financial technology based in the US.

Stanley has a Master’s degree in Economics which he earned with a dissertation on Financial Innovation and a Bachelor of Commerce degree in Accounting.