risk assessment

The identification, analysis, and measurement of *risks relating to an activity or organization. Risk assessment comprises the initial stages of *risk management, and it is one of the five components of effective *internal control identified in *Internal Control - Integrated Framework (the COSO Report). Risk assessment practices have spread beyond their historic heartlands of the insurance and financial services sectors to enter the wider organizational mainstream. In turn, the centrality to *corporate governance of both external and internal auditing has resulted in risk assessment becoming central to auditing. Auditors use risk assessment to prioritize work and to maximize resources. For example, risk assessment techniques can be used to identify suitable areas for review in a large *audit universe, and to identify specific *audit tests for a defined topic. This approach contrasts with the often cyclical nature of *audit planning prior to the 1990s. Some commentators have expressed reservations over the extensive use of risk assessment techniques in auditing: "A worry is that over emphasis on risk assessment may perpetuate the traditional culture of the risk-averse internal auditor, with risk being seen as something to avoid rather than being an opportunity to be exploited" (Vinten, 1996, 93). However, risk assessment is now generally considered to be indispensable to effective auditing. Risk assessment for both auditing and wider corporate governance purposes can take the form of *quantitative or *qualitative measurements, or a combination of the two. Some commentators make a distinction between risks (quantifiable) and *uncertainties (unquantifiable). The dangers of attempting to place overreliance on quantitative risk assessment techniques has been expressed as follows: "On occasion the calculation of risk assessment ‘formulae’ seems to provide a veneer of pseudo-scientific clarity to complex matters that cannot be captured purely by numbers... Risks are often difficult (and sometimes impossible) to quantify, and over-reliance on quantified data may reduce the scope for intuitive assessment. The risk assessor who over-relies on numbers often therefore seems to dance around the heart of the risk assessment process, never quite managing to penetrate its core. In extreme cases, over-elaborate risk assessment processes can detach themselves from the organizational realities they purport to represent. A curious scenario then develops, in which risk-assessment becomes a self-referential exercise divorced from the surrounding context. In such cases, the process has as much to do with effective risk assessment as the obsessive polishing of a car has to do with maintaining its engine" (O’Regan, 2003a, 41). In practice, risk assessment often involves a combination of quantitative and qualitative factors. Further reading: AS/NZS 4360 (1999); IIA UK (1998); Messier and Austen (2000); Reding et al. (2000); Shelton et al. (2001)