Chapter 3

Risk Assessments
Risk Assessment

It is the process of identifying, measuring, and analyzing risks

relevant to a program or process. This assessment is systematic,
iterative, and subject to both quantitative and qualitative inputs
and factors.
Identification of Risks

A key aspect of any risk assessment is the identification of the relevant risks. This
takes the form of a list of risks.

Internal auditors sometimes fail to identify relevant risks due to their lack of in-
depth knowledge about the process being audited. To avoid these issues, it is useful
to include in the risk identification exercise people with an extensive knowledge of
the program or process that will be analyzed.
Operational Risk Types/
Risk Categories

Internal constraints

• Equipment
• People
• Policies
Measurement of Risks
• Based on Impact
This can be quantitative and qualitative

• Based on Likelihood
Qualitative vs Quantitative measurement
Risk Matrix
This is a widely used and highly effective tool to record and analyze the
objectives, risks, and controls in the program or process that is being
audited.