RiskBased Audit Risk Assessment Model Excel model included

Risk-Based Audit Risk Assessment Model (Excel model included in last slide) 30/1/2565 Risk-Based Audit 1

Audit Risk Model AUDIT RISK MODEL l Purpose to prioritize audit schedule for creation of audit plan. l All risks are relative but can be compared by combining three key factors with equal overall weighting : – Inherent Risk (IR) Size of the risk or exposure. – Control Risk (CR) Likelihood that risk will materialize and – Detection Risk (DR) Probability of detection if risk materialize 30/1/2565 Risk-Based Audit 2

Risk-Based Planning - Step l l l Create audit universe by dividing functions or systems into auditable area Whole business population must be covered and division approach is consistent Evaluate risks in each function or system throughout the universe to create score for IR, CR, and DR Sub-categories in IR, CR, and DR are given different weightings to reflect their relative importance Combine overall score to create overall result which can be ranked alongside results for all other functions or systems 30/1/2565 Risk-Based Audit 3

Risk Factors Inherent Risk (IR) Parameters relating to the size of the exposure or risk A= B= C= D= 30/1/2565 Combined value of annual income and expenditure Number of employees involved Impact on the organization Volume of transactions per month Risk-Based Audit 4

Risk Factors Control Risk (CR) Parameters relating to the likelihood of the risk materializing F= G= H= J = 30/1/2565 Impact of Management and Staff Third Party Sensitivity Standard of Internal Control Likelihood of Occurrence Risk-Based Audit 5

Risk Factors Detection Risk (DR) Parameters relating to the probability of unwanted consequences being detected if they do materialize. K= L= M= N= 30/1/2565 Likely effectiveness of audit Duration of the audit Length of time since last audit Effectiveness of other assurance providers Risk-Based Audit 6

Aggregate Risk Score FORMULA USED FOR CALCULATION OF RISK FACTOR INHERENT CONTROL DETECTION (2 A + B + 3 C + D) X (2 F + G + 3 H + 3 J) X 35 45 35 (K + 2 L + 2 M+ 2 N) THE RESULT IS MULTIPLIED BY 200 30/1/2565 Risk-Based Audit 7

Audit Interval ASSESSMENT OF RESULTS SCORE >80 E 60 - 79 40 - 59 20 - 39 topic <19 N 30/1/2565 - Top H M L Priority - Critical topic for review - Important to tackle - Lower priority but still valid audit - Audit probably unnecessary Risk-Based Audit 8

Aggregate Risk Factor 30/1/2565 Risk-Based Audit 9

Audit Risk Priority 30/1/2565 Risk-Based Audit 10

Long-term Audit Plan 30/1/2565 Risk-Based Audit 11

Audit Resource Planning 30/1/2565 Risk-Based Audit 12

Risk Scoring Sheet 30/1/2565 Risk-Based Audit 13

Risk Scoring Sheet 30/1/2565 Risk-Based Audit 14

Risk Scoring Sheet 30/1/2565 Risk-Based Audit 15

Inherent Risk (IR) A - Combined value of annual income and expenditure (Baht) or value of business it supports 1. 2. 3. 4. 5. 30/1/2565 Up to 10 M Between 10 M - 40 M Between 40 M - 200 M Between 200 M - 400 M Over 400 M Risk-Based Audit 16

Inherent Risk (IR) B - Number of employees involved / persons able to access 1. 2. 3. 4. 5. 30/1/2565 Up to 10 11 to 30 31 to 50 51 to 100 Over 100 Risk-Based Audit 17

Inherent Risk (IR) C - Impact on the organization 1. "Insignificant: Low financial loss, no disruption to capability, no impact on community standing" 2. "Minor: Medium financial loss, minor disruption to capability, minor impact on community standing" 3. "Moderate: High financial loss, some ongoing disruption to capability, modest impact on community standing" 4. "Major: Major financial loss, ongoing disruption to capability, major impact on community standing" 5. "Catastrophic: Mission critical financial loss, permanent disruption to capability, and ruinous impact on community standing" 30/1/2565 Risk-Based Audit 18

Inherent Risk (IR) D - Volume of business transactions or user activities (per month) 1. 2. 3. 4. 5. 30/1/2565 fewer than 500 501 to 2500 2501 to 5000 5001 to 15, 000 over 15, 000 Risk-Based Audit 19

Control Risk (CR) F - Impact of management and staff / IT staff and users a) Quality of Management b) Extent of Staff Turnover c) Length of time operation has been within the business d) Degree of expressed concern by management e) Management's attitude to risk taking f) Morale of Staff 30/1/2565 Risk-Based Audit 20

Control Risk (CR) F - Impact of management and staff / IT staff and users 1. Top quality management and staff with low turnover of both, in an operation which has been in existence for more than three years and about which no known concern is being expressed 2. High quality management and staff 3. Medium quality management and staff 4. Below average quality management and staff 5. Poor management and staff with high turnover of both, in an operation which has been in existence for less than three months and about which a great number of concerns is being expressed 30/1/2565 Risk-Based Audit 21

Control Risk (CR) G - Third party / outsourced service provider sensitivity a) Tax Implications b) Extent of Regulatory Requirements c) Legal Implications / privacy / fraud d) Service delivery and availability 1. There are no tax, legal, regulatory or other third party implications 2. Low sensitivity 3. Moderate 4. High sensitivity 5. Very significant third party sensitivity is present 30/1/2565 Risk-Based Audit 22

Control Risk (CR) H - Standard of internal control a) Means of authority to commit (e. g. none, sole with review, dual, committee) b) Extent of losses c) Scope for intentional manipulation d) Vulnerability to fraud e) Degree of technical sophistication of systems f) Extent to which standard systems are being used g) Extent to which operating manuals are complied with h) Extent of recent reorganizations and system changes i) Known factors which should ring warning bells j) Reliability of last internal control review k) Extent of weakness highlighted in last internal control review l) Strength of accounting systems m) Extent of formal procedures n) Other IT security and controls 30/1/2565 Risk-Based Audit 23

Control Risk (CR) H - Standard of internal control 1. "Excellent: with no known significant reorganizations or systems changes; little known scope for intentional manipulation" 2. "Above Average: with standard systems in use throughout" 3. Sound 4. Known or suspected to be weak 5. Known or suspected to be very unsound 30/1/2565 Risk-Based Audit 24

Control Risk (CR) J - "Likelihood of occurrence - related to the level of Impact on the organization of Factor C (Relative Probability %)" 1. "Rare: The risk/ loss events may occur only in exceptional circumstances ( 0% - 3%)" 2. "Unlikely: The risk/ loss events could occur at some time ( +3% - 30%)" 3. "Possible: The risk/ loss events might occur at some time ( +30% - 60%)" 4. "Likely: The risk/ loss events will probably occur in most circumstances 5. ( +60 % - 97% )" 6. "Almost Certain: The risk/ loss events are expected to occur in most circumstances ( + 97% )" 30/1/2565 Risk-Based Audit 25

Detection Risk (DR) K - Likely effectiveness of audit a) Willingness and ability of client to react positively to results of audit b) Extent to which relevant specialist skills are available to internal audit c) Ability to conduct a competent audit d) The degree of need for thorough audit follow-up e) The quality of internal audit systems documentation f) Knowledge of business and experience of staff g) Involvement and availability of management 30/1/2565 Risk-Based Audit 26

Detection Risk (DR) K - Likely effectiveness of audit 1. 2. 3. 4. 5. 30/1/2565 There are significant constraints that are likely to preclude doing an effective audit i. e. a function with novices, high turnover of experienced staff, with a little knowledge of the business together with poor line management Likely to have some constraint to effective audit Medium constraint to effective audit Unlikely constraint to effective audit There are no significant constraints that are likely to preclude doing an effective audit i. e. a well-established function with fully experienced and trained staff with a good knowledge of the business together with receptive and focused line management Risk-Based Audit 27

Detection Risk (DR) L - Duration of the audit 1. 2. 3. 4. 5. 30/1/2565 Over 70 days 41 to 70 days 21 to 40 days 10 to 20 days Less than 10 days Risk-Based Audit 28

Detection Risk (DR) M - Length of time since the last review 1. Less than 12 mo or closely observed or involved during implementation phase 2. Between 12 and 18 mo 3. Between 18 and 24 mo 4. Between 24 and 36 mo 5. More than 36 mo or never audited 30/1/2565 Risk-Based Audit 29

Detection Risk (DR) N - Effectiveness of other assurance providers 1. Regular internal, QA and other audits with no significant findings 2. Regular internal, QA and other audits with some significant findings 3. No other audit work completed 4. Regular internal, QA and other audits with many significant findings 5. Continual significant problems identified by assurance reviews 30/1/2565 Risk-Based Audit 30

Q&A PAIRAT SRIVILAIRIT, CIA CCSA CFSA CBA CISSP CFE FSVP Head of Internal Audit TISCO Financial Group Public Company Limited Mobile : +668 1903 1457 Office : +66 2633 7821 Email : pairat@tisco. th 30/1/2565 Risk-Based Audit 31