The Role of Internal Auditing in Enterprise Risk Management

The role of internal auditing in Enterprise Risk Management

Every company sets objectives and tries to achieve them through the implementation of strategies. Internal auditors provide fundamental aid to the senior management by detecting possible negative events that may have an adverse impact on enterprise objectives, strategies and business models. This contribution of internal audit pertains to the event identification component. Moreover, internal auditors may evaluate risks by providing information to facilitate management decisions, employing available statistical techniques of risk assessment. Management after having assessed relevant risks has the responsibility to decide whether to accept the risk, avoid, share or to reduce it. Internal auditor’s task is to assess if the level of risk that has been taken is the permissible one. Internal audit contributes to the evaluation of sufficiency of control means that may be used by companies in order to moderate the risk. However, internal audit is also applied in the information and communication process. Enterprise risk management requires accurate, timely, reliable and objective information. Therefore, internal audit is accountable for asserting that information provided, if it is indeed timely and reliable, resulting to assure the existence of sufficient communication during risk management process. Finally, it is argued that internal auditing may be applied in all stages of risk management by (Staciokas and Rupsys 2005):

• assuring the detection of possible risks arising from negative events,

• evaluating the risks using quantitative methods needed,

• identifying if too high level of risk is accepted by top management,

• assessing the controls employed for the mitigation of risks,

• ensuring that the information needed to manage risks, will be timely and reliable.