Norman:

Great blog post. 

 I have believed for more than two decades that the primary role of IA should be to ensure that senior management and the board are aware of and OK with the organization's residual risk status. The simple rule I have used with work units is "You can accept any level of residual risk you think is OK provided you are also OK with being responsible for the decision,  and having management and, in very serious cases, the board of directors aware of the residual risk status acceptance decision.

 IA departments that do tradtiional audits and reach subjective opinions on whether internal control is "effective" and/or  whether IA thinks there are "significant or material control weaknesses" often results in conflicts between IA and management.  It can also result in cases where management is forced by reward systems and politics  to address control issues identified by IA and use scarce resources to address the points raised by IA  when there are other areas of the business with far more dangerous residual risk status that the resources should be directed to.

I believe IA should do all audit work using a methodology similar to ISO 31000, provide those assessments including risks identified and ratings attached with the related risk treatments and residual risk status to management.  If they are going to make decisions on acceptability of risk they should be required to describe exactly how they determined that the residual risk status is outside of the organization's risk tolerance.  In my experience very few organization's have explicitely articulated their risk tolerance for all types of objectives.

Norman:

For the minority that have a robust self-assessment framework I agree completely with your comments above.  I absolutely do not agree that IA should be the primary risk assessor.

In my experience only a minority have robust and demonstrable self-assessment systems in place.  Unfortunately, IA and other specialist assurance groups still act as the primary group risk/control analyst/reporters. I agree that in cases where work units do little or seriously deficient risk/control assessments this is a deficiency that IA should report. Recent surveys done by COSO indicate that a large percentage of US companies are still at that stage.  

More and better traditional internal audits where IA acts as the primary/risk control analyst is not the answer but it is an easy role to continue doing, particularly when senior management and boards are OK with it.Many IA departments are still measured primarily on whether they complete their planned number of traditional internal audits.
 
In 1985 at Gulf Bruce McCuaig and I concluded that IA had to get out of the role of being primary risk/control analyst/reporters. Our response was to terminate tradtional internal audits, provide a full explanation to senior management and the board and focus efforts on implementing a robust risk/control self-assessment framework.   

My wish for 2011 is that the IIA do everything in its power to help IA departments that function as their company''s primary risk/control analysts and reporters transition out of that role to one that focuses on reporting on the maturity and effectiveness of the organization's risk management frameworks, in particulary its ability to provide reliable information on the organization's residual risk status.

After reading the comments in reaction to the article, I hope I can sense some movement with respect to risk management and its relationship to audit. It is critical that risk managers and auditors understand each other and are willing to work together to precipitate course correction in both the public and private sectors.  There is so much more to say, and a lot further to go integrating the two effectively in business planning and practice. The more I learn, the more clear it becomes to me that the process of managing risk has become a mammoth task that we as practitioners are still trying to grok. Another good read, Norman, and thanks.

Determining risks is the first step. Determining risk tolerance and residual risk comes later. The important thing is that once risks are determined the decision process begins of whether to control or mitigate the risks or to share, transfer or accept the risk (residual). However, the costs of the risk should never out weight the benefits of the risks (revenues). This is the main focus of what auditors try to accomplish. Somehow the fact that auditors put so much focus on risks dilutes the effect of risk management making sure the costs don't out weight the benefits. Determing risks and controls can be time consuming but it can also save alot of money and time wasted on trying to recover from not knowing and responding to risks in advance.

In response to the question, I would point to the ISO definition of risk tolerance: the "organization's or stakeholder's readiness to bear the risk after risk treatment in order to achieve its objectives". COSO, if that is your preference, uses the term risk appetite for the same concept: "the degree of risk, on a broad-based level, that a company or other entity is willing to accept in pursuit of its goals."

See next comment for continuation

 In my previous organization, audit department seen as a bunch of sadists for a long time. However, our department worked hard on to create some reasonable and cost-beneficial suggestions. Eventually, we succeeded. Therefore, audit departments, especially the newly established ones, should work extremely hard to break the misleading perceptions. Once they accomplish this, the rest of the audit job is going to be at least fifty percent easier. I would like to comment on risk levels but I think it could be a better idea to bring up a case and make the discussion based on that case.