Audit & Risk Management

Business typically throw up challenges, risks, threats and opportunities for the organizations in a dynamic business world. Much of the organizational success depends upon the ability of the management to foresee the risks as well as emerging opportunities. Risk management therefore holds the key to keep the Pandora's Box closed or open the doors to opportunities.

 

Risk assessment involves identification, measurement and prioritization of entity risks at the operational as well as at the strategic levels. This exercise enables the management to take informed decisions on whether to manage the risks in-house, avoid them with alternative strategies, share them with others say with stake-holders, transfer the risks to others such as insurance. Risk management becomes strategic for survival in corporate world, or in politically sensitive scenarios of public sector governance, or to ensure effectiveness of donor funded programs and projects.

 

Red Flag experts are drawn from different backgrounds so that they address the unique requirements of specific private and public sector industries, 'country-province-local government' scenarios, or non-profit organizations to name a few. The methodology and the rigors of its application vary with the parameters of unique situation. At the heart of all risk assessment exercises, there is due diligence performed for assurance on quality of the product.

 

The risks are typically assessed using the probability of their occurrence (likelihood) and the estimated impact on the organization, tactically and strategically.

​

Internal audit (IA) functions in medium and large entities are designed to focus on key risks facing the entity, the regulatory compliance issues, the mandatory audits such as that of internal controls and financial statements. Internal audit is an emerging profession that is more value added to the management than perhaps the attestation audits.

​

Realizing the capacity and capability limitations in many organizations, many entities have resorted to outsourcing fully or partly the internal audit functions. Red Flag is prepared for the outsourced internal audits that may take any of the following forms and many more.

 

• Setting up the internal audit function.

• Preparation of risk based annual action plan for the IA function.

• COSO (Committee of Sponsoring Organizations of the Treadway Commission) based evaluation of internal controls or implementation of controls model.

• Financial Statements audit prior to attestation audit.

• Audit of organizational strategies and/or operations.

• Audit of projects, programs or funding arrangements.

• Preparing/conducting the organization for the External Assessment of Internal audit activity under the standards.

• Information systems audit including COBIT (Control Objectives for Information and Related Technologies) based assessments.

• Writing of Audit manuals, and charters for the Internal audit function, Audit committee.

• Audits on behalf of third parties on agreed upon criteria.

• Compliance auditing.

• Due diligence audits including under the Sarbanes-Oxley Act (SOX).

• Audit performance review under Balanced Score Card methodology