Role of Internal Audit on Risk Culture

Abstract

Typical risks of poor culture reflect in business strategies far from firm values and sound conduct, remuneration criteria facilitating business short-term objectives and failures in accountability. The internal audit function can play a fundamental role in providing either assurance or consulting on risk culture to a company governing bodies. This chapter analyzes the role of Internal Audit on such matter and examines how the audit approach evolves together with the level of pervasiveness of risk culture within the company. In our view, the audit assurance on risk culture shall leverage on an assessment of the comprehensive risk culture framework extended to the entire perimeter of functions of a company (e.g. risk management; compliance; HR; business). Such assessment shall be usefully underpinned by the evaluation of risk culture control objectives and risk culture indicators, aimed to evaluate respectively qualitative and quantitative indicators of risk culture (reported in extent in the appendix). To this end the audit reporting evolves as well, to broaden its perimeter from traditional assurance on the control environment to an assurance on risk culture awareness and management.

Appendix 18.1 Control Objectives and Risk Culture Indicators