Time and resource constraints mean audit teams cannot examine every process, control, and risk with the same level of detail. Giving every area equal attention can divert resources to lower-priority issues while leaving significant risks without sufficient examination.
A risk-based audit helps address this challenge by focusing audit work on areas that could have a greater impact on financial reporting, operations, or compliance. Auditors also need to explain why some risks receive more attention than others. Documenting the reasoning behind these decisions makes audit scoping more transparent and easier to justify during review.
In this article, I will explain how auditors assess and rank risks, walks through the steps involved in conducting a risk-based audit, uses a procurement example to illustrate the approach, and explains how risk ratings inform control testing during fieldwork.
What Is a Risk-Based Audit?
A risk-based audit directs audit resources toward areas where assessed risks pose the greatest potential impact on the organization's objectives. Rather than applying the same level of coverage to every process, auditors prioritize areas that warrant closer examination based on the risk assessment and engagement objectives.
Risk assessment informs three key decisions: audit scope, the nature and extent of testing, and how resources are allocated across an engagement. The extent to which resources are committed to an area typically reflects the importance and urgency of the risks, and the lesser the risk, the more acceptable it is to defer consideration to a later time.
Risk identification determines what could go wrong and how it could affect the organization's objectives. Risk prioritization then determines how much audit attention each identified risk warrants, based on the assessment criteria, supporting evidence, and professional judgment.
There are three terms that are particularly relevant to the discussion. Inherent risk is the exposure that exists before any controls or other risk responses are put in place. Residual risk is the exposure that still exists after risk responses are taken. Control effectiveness refers to how well controls are designed and how well they work to mitigate the risks they are intended to address. Auditors should have sufficient evidence to evaluate control effectiveness and reach a conclusion about the effectiveness of the controls, rather than making an assumption based on a control design and intent document.
How Does a Risk-Based Audit Approach Work?
The process comprises a series of steps, including risk identification, risk assessment, audit planning, risk prioritization, definition of audit scope, testing of controls, and assessment and documentation of results.
The difference with a risk-based approach is in the distribution of the audit work across different processes and activities. A risk-based approach means that higher priority risks may require a more extensive or targeted examination. However, the procedures performed depend on the objectives of the engagement, the requirements, the available evidence, and the professional judgment of the auditor.
Audit findings may also provide the auditor with new information, which may result in a re-evaluation of the risk assessment and cause the auditor to rethink the prioritization of risks and the procedures performed.
A high risk score is one of the inputs, but it is not the deciding factor in prioritizing the risk.
How Auditors Prioritize Risks in a Risk-Based Audit
Prioritizing risks is the heart of a risk-based audit. To determine which risks should be prioritized, auditors take into account several factors.
Assess Likelihood and Potential Impact
Auditors analyze the likelihood of the risk event occurring and the effect it would have on the organization's financial statements, on the organization's operations, on the organization's compliance with the laws and regulations, and on the organization's broader objectives.
Consider Inherent and Residual Risk
Inherent risk is the exposure that exists before considering the effects of management actions and controls. Residual risk is the exposure that remains after those responses are considered. Before relying on a residual risk rating, auditors should evaluate the available evidence of control effectiveness. A control's presence in documented policies or procedures does not, by itself, demonstrate that it operates effectively.
Evaluate Factors Beyond Numerical Scores
A likelihood-and-impact score is a guideline and not an assessment. Auditors should take into account other factors such as materiality, fraud exposure, the complexity of the process, changes in the business, findings from previous audits, and the assurance given by other service providers. Two risks with the same score may require different levels of attention based on the above factors.
Document Why Risks Receive Different Priorities
Auditors should document the evidence, assumptions, scoring rationale, and professional judgment supporting significant prioritization decisions. This helps reviewers understand why certain risks received greater attention and how the assessment informed the audit scope and planned procedures.
How to Conduct a Risk-Based Audit: Step by Step
Each step below produces a specific output, helping auditors move from risk identification to targeted audit work.
Identify the risks: Gather information from risk registers, audit findings, incident reports, process documentation, and stakeholder discussions to identify risks relevant to the engagement objectives. Output: A documented inventory of identified risks.
Assess the risks: Evaluate each risk's likelihood and potential impact, documenting the supporting evidence, assumptions, and rationale behind the rating. Output: A documented risk assessment.
Evaluate relevant controls: Identify controls intended to address each risk and assess whether their design appears appropriate. Determine what additional evidence or testing is needed to evaluate control effectiveness. Output: A risk-control mapping with identified evidence and testing needs.
Rank the priorities: Apply the established assessment methodology while considering materiality, prior findings, mandatory requirements, and other relevant factors. Document the rationale for significant adjustments to the rankings. Output: A prioritized risk register.
Determine the audit response: Select the risks and controls requiring further examination, define the engagement scope, and plan appropriate audit procedures. For broader audit planning, the IIA’s guidance on risk-based internal audit planning. Output: Documented scope rationale and a planned audit work program.
Allocate audit effort: Estimate the skills, time, and resources required to perform the planned procedures, taking account of engagement constraints and dependencies. Output: A resourced engagement plan.
Reassess when conditions change: Revisit the risk assessment and planned work when significant incidents, system changes, acquisitions, or control failures alter the risk profile. Output: An updated risk assessment and documented changes to planned audit work.
How to Score and Rank Audit Risks
Use a Risk Assessment Matrix
Audit teams frequently find it helpful to use a simple 3x3 or 5x5 risk assessment matrix to rank and compare audit risks. Consistent definitions of each score level need to be determined by the reviewers prior to scoring. A lack of consistency in defining levels will lead to inconsistent scoring, and therefore, comparison of audit risks will be difficult.
Apply a Consistent Risk Scoring Method
One way to score risks is as follows:
Likelihood: Rated from 1-5.
Impact: Rated from 1-5.
Initial risk score: Likelihood multiplied by impact.
The likelihood × impact formula produces an initial risk score, not a definitive measure of risk or audit priority. Auditors should interpret the score alongside qualitative factors, supporting evidence, materiality, control effectiveness, and professional judgment rather than relying on the numerical result alone.
Turn Risk Scores Into Audit Priorities
Using thresholds, risks may be categorized as high, medium, or low. Factors other than risk (i.e., existing audit requirements, materiality, significance of control weaknesses, previous audit findings, and emerging risks) may influence the ultimate priority of an audit, even when the risk scoring and matrix indicate a different priority.
The risk score provides a starting point for prioritization. Auditors should consider supporting evidence, relevant qualitative factors, and professional judgment before determining the appropriate audit response.
Risk-Based Audit Example: How to Prioritize Control Testing
A procurement process has three potential risk areas. Using illustrative likelihood and impact ratings of 1 to 5, an auditor can calculate an initial risk score.
Risk area | Likelihood | Impact | Initial risk score |
Unauthorized vendor changes | 4 | 5 | 20 |
Duplicate invoice payments | 3 | 4 | 12 |
Purchases made without timely approval | 2 | 3 | 6 |
Initial risk score = Likelihood × Impact
These ratings and scores are hypothetical and are not industry benchmarks. They illustrate an initial risk assessment, not a final determination of audit priority or control effectiveness.
The initial scores help inform the auditor's decision about which issues to examine first. In this example, vendor authorization and vendor-change controls may warrant further attention. The auditor would then review the relevant controls, examine supporting evidence, and determine the appropriate procedures and testing coverage based on the engagement's objectives and applicable requirements.
When applying this method to an engagement, consider these questions:
Which risk has the greatest potential impact?
What evidence supports each risk rating?
Which controls are designed to address the identified risks?
What testing procedures would provide relevant evidence?
How should the prioritization rationale and testing decisions be documented?
This approach gives auditors a practical starting point for prioritizing audit work. The final decisions should reflect the assessed risks, the supporting evidence, and the circumstances of the engagement.
How Risk Assessment Influences Audit Scope and Control Testing
Priorities should be reflected in fieldwork, not simply in a planning document.
Map Risks to Relevant Controls
Auditors map identified risks to relevant preventive and detective controls, where applicable. This mapping helps determine whether controls address the risks and provides a basis for defining control-testing objectives and procedures.
Define the Testing Objective
Relevant control and risk objectives are integrated to determine what needs to be tested to meet the engagement objective. Using an audit procedure performed in a prior audit without ascertaining if it is still relevant to the risks and circumstances for the current audit may result in ineffective audit work.
Determine the Evidence and Extent of Testing
Auditors use professional judgment to determine the nature, timing, and extent of procedures needed to obtain appropriate evidence. Relevant considerations include the control's characteristics and frequency, the population being tested, the sample size where sampling is used, and the assessed risks. The procedures should provide a reasonable basis for evaluating the control against the engagement objective.
Document the Rationale
Audit workpapers should document the links between risks, controls, procedures, evidence, and conclusions. This helps reviewers understand the rationale for the work performed and assess whether the evidence supports the conclusions reached.
Common Risk-Based Audit Mistakes and How to Avoid Them
Relying solely on management-assigned risk ratings
Independently evaluate the evidence supporting or contradicting management's ratings. Consider previous audit findings, incidents, and changes in the business or control environment.
Applying likelihood and impact scores inconsistently
Prior to starting the assessment, define the parameters for the scores, and apply them consistently to comparable risks. Document any inconsistencies or adjustments and explain the reason for any changes.
Ignoring significant changes in the business or control environment
Determine the conditions that would justify reassessment, and take them into account when significant changes occur in the business or control environment (i.e., mergers, system changes, process or control changes, etc.).
Choosing audit procedures without linking them to identified risks
Ensure that planned audit procedures pertain to the engagement objectives and the identified risks. Make sure the procedures are designed to evaluate the controls related to those risks.
Failing to document why particular risks and controls were prioritized
Record the rationale for risk ratings, prioritization decisions, and scope selections when they are made. This supports review, traceability, and consistent decision-making throughout the engagement.
How Roz Supports Risk Assessment and Control Testing
Roz is built for the fieldwork that follows a risk assessment, not for determining audit priorities. Once risks and controls are identified, Roz helps audit teams organize engagement information and evidence in client-specific workspaces and connect existing risk and control documentation to relevant controls and supporting evidence.
Roz accelerates first-pass control testing using defined or AI-suggested attribute checks against evidence and sample sets. Completed control activities can be exported as formatted workpapers with supporting evidence, annotations, and audit trails.
Auditors review AI-generated results, investigate potential exceptions, and retain responsibility for audit priorities, professional judgment, and final conclusions. Roz supports fieldwork and documentation; it does not independently determine audit priorities or replace the auditor’s risk assessment.
Conclusion
A risk-based audit is ultimately about making defensible decisions regarding where audit attention is most needed. Effective prioritization connects risk assessment to audit scope, control testing, evidence evaluation, and documented conclusions.
The key takeaway is that auditors should be able to explain not only which risks they prioritized but also why those risks warranted specific audit procedures.
Frequently Asked Questions
How is an audit risk assessment calculated?
Many audit teams rate risks by likelihood and impact. Some multiply scores on a 1-5 scale to produce an initial risk score. Scoring methods vary by organization and engagement. Do not solely rely on scores to determine the overall risk. Other factors, including control effectiveness and materiality, should also be considered.
What is the difference between inherent risk and residual risk?
Inherent risk is the exposure that exists before you consider the effect of management’s actions or controls. Residual risk is the exposure that remains after appropriate risk responses and controls are put in place. You should evaluate the control effectiveness and the evidence supporting it prior to relying on residual risk.
How does a risk-based audit affect control testing?
A risk-based audit uses the assessed risks to determine which controls require attention and what testing is appropriate. Higher-priority risks may warrant more extensive or targeted procedures, depending on the engagement objectives and applicable requirements, available evidence, and control characteristics. The auditor determines the final scope and extent of testing using professional judgment.
How often should auditors update risk assessments?
The frequency of risk assessment depends on the organization's risk environment, applicable requirements, and changes in its business or control environment. Under the IIA's Global Internal Audit Standards, the organization-wide risk assessment that informs the internal audit plan must be performed at least annually. Significant changes in risks or business conditions may also require the internal audit plan to be updated during the year.
