Reporting on the Effectiveness of Risk Management and Control

Reporting on the Effectiveness of Risk Management and Control: CIA Part 3 Guide

Overview
A large part of internal auditing's value comes from telling the board and senior management, clearly and credibly, whether the organization's risk management and control processes are working. This topic covers how internal auditors form, support and communicate conclusions about that effectiveness. It applies to single engagements and to the overall, organization-wide view. It is a frequent CIA exam topic because it links audit standards, control frameworks, professional judgment and communication skills.

Why It Is Important
1. It is the core of assurance. The board relies on internal audit for an independent and objective view of whether risks are managed within risk appetite. If the reporting is weak, the assurance is weak, however good the fieldwork was.
2. It supports governance and decision-making. Audit committees use these conclusions to oversee management, allocate resources, challenge risk acceptance and meet regulatory expectations. Examples include corporate governance codes and Sarbanes-Oxley Section 404 for internal control over financial reporting.
3. It drives improvement. Clear conclusions, supported by root-cause analysis, lead management to take corrective action.
4. It is required by the Standards. The IIA Global Internal Audit Standards (2024) expect the following:

• The chief audit executive (CAE) communicates results to the board and senior management, both for each engagement and periodically.
• This includes conclusions on the effectiveness of governance, risk management and control processes (Principle 11 and Standard 11.3, Communicating Results; Standard 14.5, Engagement Conclusions).

Under the previous IPPF, the same ideas appeared in Standard 2060 (Reporting to Senior Management and the Board), Standard 2410 (Criteria for Communicating) and Standard 2450 (Overall Opinions).
5. It protects the organization and the audit function. Overstated or unsupported opinions expose the organization to false comfort and expose internal audit to credibility and liability risks.

What It Is
Reporting on effectiveness means expressing a professional judgment on whether governance, risk management and control processes are designed adequately and operating effectively to achieve objectives and keep risk within acceptable levels. It has two levels:

Engagement-level (micro) conclusions

• Cover one process, unit, system or project, such as procurement or IT change management.
• Appear in the final engagement communication.
• Often use a rating such as Satisfactory/Effective, Needs Improvement/Partially Effective, or Unsatisfactory/Ineffective.

Overall (macro) opinion or conclusion

• Covers the organization as a whole, or a broad area such as all of internal control.
• Is usually issued annually by the CAE.
• Is built by aggregating multiple engagements, other assurance providers' work, management's own assessments and knowledge of the business.

Key concepts

• Design adequacy vs. operating effectiveness: A control may be well designed but not performed consistently. An effective conclusion requires both.
• Reasonable (positive) assurance: A direct statement, for example: 'In our opinion, controls are effective.' This requires sufficient scope and evidence.
• Limited (negative) assurance: For example: 'Nothing came to our attention that indicates controls are ineffective.' This is used when the work performed is more limited.
• Criteria: The benchmark used to judge effectiveness. Examples are COSO Internal Control-Integrated Framework (2013), COSO ERM (2017), ISO 31000, policies, laws and contracts.
• COSO effectiveness test: An effective internal control system requires all five components to be present and functioning and operating together. The five components are control environment, risk assessment, control activities, information and communication, and monitoring activities, supported by 17 principles. A major deficiency in any component means the system cannot be concluded effective.
• Deficiency severity: Control deficiency, then significant deficiency, then material weakness (in the ICFR context). Severity depends on likelihood and magnitude.

How It Works: The Process
Step 1: Plan the basis for the opinion.

• Agree with the board and senior management whether an overall opinion is expected, its scope and the criteria to be used.
• Design the audit plan so that coverage is enough to support that opinion. This should be risk-based and include coordination with other assurance providers (Standard 9.5, Coordination and Reliance).

Step 2: Gather sufficient, reliable, relevant and useful evidence.

• Perform walkthroughs, test controls and analyze data.
• Evaluate the risk management elements: objectives are aligned with the mission, risks are identified and assessed, responses are appropriate to risk appetite, and relevant information is communicated in a timely way.

Step 3: Evaluate findings.

• For each finding, document the elements of a finding: criteria, condition, cause (root cause), effect (impact) and recommendation or management action plan.
• Assess significance, including likelihood, impact, pervasiveness and qualitative factors such as fraud, compliance and reputation.

Step 4: Develop the conclusion.

• Under Standard 14.5, internal auditors summarize findings and consider them together, both individually and in aggregate.
• They then judge the effectiveness of the processes reviewed.
• Several minor findings in the same area may together indicate a significant weakness.

Step 5: Rate and communicate.

• Use the organization's rating methodology consistently.
• The final communication should include:
  • objectives
  • scope, including limitations
  • findings
  • conclusions or opinion
  • recommendations and management action plans
  • responsibilities and target dates
• It should also recognize satisfactory performance where appropriate.
• Communications must be accurate, objective, clear, concise, constructive, complete and timely.

Step 6: Aggregate for the overall opinion.

• The CAE combines the following:
  • engagement results
  • work of other assurance providers that internal audit relies on
  • themes and trends
  • significant risk exposures, including fraud risks
  • governance issues
  • the status of open actions
• The overall opinion must state:
  • the scope and time period
  • any scope limitations
  • the sources relied on
  • the risk or control framework used
  • the opinion or conclusion itself
  • the reasons for an unfavorable opinion

Step 7: Escalate unacceptable risk acceptance.

• If management has accepted a level of risk that the CAE believes exceeds the organization's risk appetite, the CAE first discusses it with senior management.
• If it is not resolved, the CAE communicates it to the board (Standard 11.5; formerly Standard 2600).
• Internal audit does not itself decide to accept or reject the risk.

Step 8: Monitor and follow up.

• Track management action plans.
• Report overdue or ineffective actions to senior management and the board.

Common Pitfalls

• Giving an overall opinion without enough coverage.
• Relying on other providers without evaluating their competence, objectivity and due professional care.
• Ignoring scope limitations.
• Concluding a system is effective when one COSO component has a major deficiency.
• Reporting symptoms instead of root causes.
• Letting management dilute ratings in a way that compromises objectivity.

Exam Tips: Answering Questions on Reporting on the Effectiveness of Risk Management and Control
1. Look for sufficiency of evidence first. If a question asks whether the CAE can issue an opinion, the best answer usually depends on having adequate scope and sufficient, appropriate evidence. Without enough coverage, the opinion should be limited, qualified or not given.
2. Know who is responsible for what.

• Management owns risk management and internal control and is responsible for designing and operating controls.
• The board oversees.
• Internal audit provides independent assurance and advice.

Answers that make internal audit responsible for implementing controls or accepting risk are usually wrong.
3. Distinguish design from operation. Testing operating effectiveness is pointless if the design is inadequate. If a scenario describes a flawed design, the conclusion is ineffective regardless of how consistently the control is performed.
4. Aggregate findings. Watch for questions where individual issues seem minor but together reveal a systemic control environment or monitoring weakness. The Standards require considering findings in aggregate.
5. Match the assurance level to the work.

• Extensive testing supports positive (reasonable) assurance.
• Limited procedures support negative (limited) assurance.
• Absolute assurance is never possible. Eliminate any choice promising it.

6. Remember the required elements of an overall opinion. These are scope, time period, limitations, reliance on others, the framework or criteria, the conclusion itself and reasons for an unfavorable opinion.
7. Reliance on others requires evaluation. Before relying on the work of other assurance providers, the CAE must assess their competence, objectivity and due professional care. The CAE still retains responsibility for the conclusions.
8. Escalation order matters. For unacceptable residual risk, the CAE discusses with senior management first, then the board. Answers that skip senior management or go to external parties first are typically wrong, unless law requires otherwise.
9. Use COSO logic. All five components must be present, functioning and operating together. A major deficiency in one component means the system cannot be concluded effective. Compensating controls may reduce severity only if they actually address the same risk.
10. Focus on root cause and constructive tone. The best recommendation addresses the underlying cause, not the symptom. The best communication is objective and balanced, and acknowledges satisfactory performance.
11. Watch the wording. Terms like 'most appropriate', 'primary' and 'first' signal priority. Pick the option most aligned with the Standards, independence and the interests of the board.
12. Old and new terminology. Exam items may use either the new Global Internal Audit Standards wording (engagement conclusions, themes, Standard 11.3) or older wording (overall opinion, Standard 2450, macro and micro opinions). The underlying concepts are the same.

Practice Scenarios
Scenario 1
Situation: The board asks the CAE for an annual opinion on internal control. However, the audit plan covered only 40% of high-risk areas, and no other assurance providers covered the rest.
Best answer: Disclose the scope limitation. Then either limit the opinion to the areas covered or explain why an overall opinion cannot be given.

Scenario 2
Situation: Testing shows a reconciliation control is performed monthly as documented. However, the control does not address the key risk of unauthorized journal entries.
Best answer: The control is ineffective due to a design deficiency.

Scenario 3
Situation: Management decides not to fix a significant cybersecurity weakness, citing cost. The CAE believes the residual risk exceeds risk appetite.
Best answer: Discuss with senior management. If unresolved, communicate the matter to the board.

Scenario 4
Situation: Five low-rated findings across different processes all stem from inadequate staff training on policies.
Best answer: Report the theme as a potentially significant, systemic issue affecting the control environment, with a root-cause recommendation.

Summary
Reporting on the effectiveness of risk management and control turns audit work into actionable assurance. To answer exam questions well, remember four things:

• The opinion must rest on adequate scope, sufficient evidence and defined criteria.
• Findings are evaluated individually and in aggregate.
• Communications are objective, clear and complete.
• Management owns controls, while internal audit independently evaluates and escalates to the board when necessary.