My Reading on ASQ CQA HB Part I-IA~IE-s

Part IB
Risk- Based Auditing
Some audit programs may allocate resources specifically to areas that have been problematic or
that are high risk. This could include product characteristics, product or process hazards,
personnel or process safety, and environmental controls. This is often called risk- based auditing.
A starting point for risk- based auditing is for the organization to identify and quantify its risks.
Risk-based auditing is a style of auditing which focuses upon the analysis and management of risk.
In the UK, the 1999 Turnbull Report on corporate governance required directors to provide a
statement to shareholders of the significant risks to the business. This then encouraged the audit
activity of studying these risks rather than just checking compliance with existing controls.[1]
Standards for risk management have included the COSO guidelines and the first international
standard, AS/NZS 4360. The latter is now the basis for a family of international standards for risk
management - ISO 31000.
A traditional audit would focus upon the transactions which would make up financial statements such
as the balance sheet. A risk-based approach will seek to identify risks with the greatest potential
impact. Strategic risk analysis will then include political and social risks such as the potential effect of
legislation and demographic change. An experiment suggested that managers might respond to riskbased
auditing by transferring activity to accounts which are ostensibly low risk. Auditors would need
to anticipate such attempts to game the process.
https://en.wikipedia.org/wiki/Risk-based_auditing
Internal auditors and some external auditors should be aware of the existence of risk and that
effectiveness, efficiency, performance, and risk are important factors when determining the
purpose of the audit or when planning the annual audit schedule. In this section we have
discussed organizational risk as a purpose of an audit. Later we will discuss audit program risk
and audit process risk.
Charlie Chong/ Fion Zhang