Risks and Controls

"Risk" is anything that may prevent the achievement of a goal. Risk assessment is a service where auditors assist clients by identifying and defining corporate risks. Then the risks can then be associated with controls based on the company's business objectives as defined by management.

"Controls" are policies and procedures that are implemented to manage and minimize risks to meet corporate objectives. With proper controls in place, risks are detected and then managed. The significance of corporate risks can be measured and the likelihood of their occurrence can be predicted.

The Auditor as Facilitator

In order to begin the risk assessment process, the auditor must become a facilitator, serving as a catalyst to guide people through specific processes to produce desired outcomes. A good facilitator generates discussion from a cross section of the department being assessed.

This is most effectively accomplished in small groups of a dozen people or less. The best facilitators seek an understanding of the business as it relates to the people "in the trenches" of a firm's day-to-day operations. Facilitators are process consultants who evaluate the company's operations to identify how effectively its goals are being met.

Several characteristics are evident in an effective facilitator, including both objectivity and an open mind. While accounting principles may appear inflexible and rigid, further inquiry often reveals the existence of available alternatives.

For example, a company's main objective may be to maximize profits, so the auditor must determine whether cost effective delivery of quality products or services are meeting provider and customer expectations. A basic understanding of how the business operates and what is required for profitable delivery of goods or services is necessary to properly identify the risks involved so that the company can develop effective controls to minimize the risks and maximize profits.

Information about the business and its various departments must be gathered and evaluated in conjunction with business goals. This is where the auditor becomes more of a facilitator. Each department must be convinced to discuss - openly and honestly - its operating procedures, as well as its strengths and weaknesses.

The facilitator should use open-ended questions to elicit comments and gather all needed information. He should lead the group to be part of the solution without taking complete control. He should not feed the group its controls, but rather redirect their thoughts toward the topic being discussed with open-ended questions.

When input from all participants is generated, everyone may identify risks and participate in the development and design of controls. It must be kept in mind that the auditor will complete the audit and leave the day-to-day operations of the corporate client. The goal of the facilitator is to help the client's management team identify risks and implement controls that will assist in the achievement of the client's goals after the auditor completes the audit.

Once a risk is identified, then the controls chosen to manage that risk must be designed so that they can be actually used by the client's employees as part of the new standard operating procedures established as a result of the audit.

The Effective Auditor

A basic understanding and knowledge of the business to be audited is crucial to facilitators. This will provide a frame of reference from which to begin their work. They must also have the ability to think quickly on their feet.

These characteristics will make departmental participants more at ease and help build rapport among those who must work together for a common goal. The facilitator can ask open-ended questions to encourage creative discussion, and help the participants identify risks and choose controls which are effective in managing those risks.

An auditor's expertise is derived from several areas. Formal education and training in the field of general accounting principles are coupled with those of law, government and the specific line of business of the corporate client to be audited. While the basic standards of an audit are rigid and well defined, an auditor must gain expertise in the field of the corporate client, so that the audit is tailor made for the client.

The auditor must be prepared. To avoid wasted time, he must plan meetings with a formal agenda. The agenda will provide a framework to direct resources; however, the auditor should remain flexible and willing to make last minute changes should a particularly important issue arise during a meeting.

It is important that the auditor articulate his expectations clearly to everyone involved. He must identify the goals to be accomplished at the meeting so he can focus the direction of the group. Participants respond to a logical, organized approach. The longer or more complicated and technical the issues to be addressed at the meeting, the more important it is that the meetings are organized.

It takes both organization and mental stamina to actively listen for long periods of time. The auditor must concentrate on the subject matter and sometimes interpret what is heard so facts or ideas can be repeated to the group in the form of questions, thus generating more focus and input. All this will aid in the development of controls, which will effectively manage risk and maximize the potential of the client.

Corporate auditors in today's business environment facilitate more effective management by a variety of methods. Highly skilled auditors are facilitators who are well prepared and flexible. They are adept at identifying specific risks facing the client and designing controls to minimize those risks. In addition, they are able to help whole departments improve the way they run day-to-day operations, while providing the management team with data required to make informed decisions in their roles with the company.