AUDIT ANALYTICS AUDIT

ESSAY 6: MANAGING RISK AND THE AUDIT PROCESS
objectively quantifiable and verifiable, it would be an unsatisfactory
indicator.
Second, a KRI must be relevant, meaning that changes in the measure
must result in corresponding alterations in the probability of target risk
event emergence. For instance, employee turnover rate might be
considered as a proxy for risk of having material errors in the financial
statements. While this seems a reasonable assumption, if the measure is
not found to be highly predictive of the risk event, then it would not be a
useful KRI in this context.
Beyond being measurable and relevant, KRIs should also be
non-redundant, easy to monitor, and auditable (Scandizzo 2005). To meet
the first of these criteria, if two or more KRIs are highly correlated, then
only one of the metrics is needed. Presumably, the retained KRI would be
that which provides the greatest benefit in terms of risk monitoring and
assessment quality. In fulfilling the second criterion, each KRI should be
relatively easy and cost-effective to measure and report. To meet the final
requirement, complete documentation of all indicators and
corresponding data sources used for measurement should be consistently
maintained. Table 6-1 provides some theoretical KRIs and associated
applications so as to facilitate initial thinking about risk measure
development.
Table 6-1: Subset of Potential Key Risk Indicators
Key Risk Indicator
Segregation of duty violations
Percent of uncollected sales
Customer financial health
Customer complaints
Accounting employee turnover
Password reset requests
Ratio of book value to fair value
for depreciable assets
Customer attrition
Research and development
spending
Tone of media coverage
Phishing incidents
To monitor risk of problems relative to:
Internal control failures and
misappropriation of assets
Estimation quality and manipulative
earnings management
Cash flows, collections, and debt covenants
Sales and customer base; product, labor, and
process quality
Error, fraud, and earnings management
Control failure, fraud, data integrity or loss
Estimation quality, errors, and manipulative
earnings management
Revenues and debt obligations
Innovation, vision, organizational health,
and management
Corporate governance; management
policies and practices
Controls, external fraud, and data
compromise
135