The following report gives the audit director and risk managers the possibility to easily detect possible inconsistencies between risk ratings, effectiveness of mitigating controls and materializing incidents.

1) Check risk management's ability to reduce risk ratings by comparing residual risk with risk appetite.

2) Check effectiveness of controls in mitigating risks.

3) Compare risks and controls against incidents.

 

Example: If risk management assesses residual risk as satisfactory but the mitigating controls are deemed inadequate and incidents keep on materializing, these risks and their mitigating controls may be worth including in the next risk-based internal audit.

HOPEX Enterprise Risk Management.