It is critical for internal audit to develop a systematic means to analyse risk. Risk is any event that could prevent the company from achieving its business objectives. A risk assessment allows the auditor to consider how potential events might affect the achievement of business objectives. The risk assessment process begins by defining the audit universe. The audit universe includes all of the business units, processes and operations. Next, the auditor must understand the company’s business model within the context of its industry and its key business objectives. Through dialog with stakeholders, internal audit should confirm its understanding of the audit universe, key business objectives and risks inherent in.
