vaayaa Inclusive Education
Finance risk assessment

Internal, External and IT Audit Risk Assessment: Evidence, Independence and Access Controls

A worked example of how audit teams identify, rate and control risks to evidence quality, auditor independence, system access, data integrity and fraud detection across internal, external and IT audit work.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Internal, External and IT Audit course

Executive summary

This assessment shows how an audit function can identify, rate and control the risks that threaten the quality of its own work. It covers internal audit, the working relationship with the external auditor and the review of IT controls. Eight risks were selected because they are plausible in everyday audit work. Weak access controls and missed fraud carry the highest inherent scores, while evidence quality and population errors are more likely but easier to control. Each risk is scored before controls and again after existing and added controls. Most fall to Medium or Low once controls are in place, but access control stays at Medium because the impact of an undetected conflict is serious. The first actions are a conflicts check before each engagement, a quarterly access review, a population reconciliation at source and a closure rule for findings. The scores illustrate method for a teaching organization and do not describe any real audit.

Focus area
Internal, external and IT audit assurance
Setting
Finance and assurance functions of a mid-sized organization with an internal audit team, an external auditor and IT systems in audit scope
Method
Five by five likelihood and impact risk register with inherent and residual scoring

Scope

This assessment covers the audit lifecycle for a mid-sized organization, from risk based planning and scoping to fieldwork, reporting and follow up of findings. It covers the internal audit function, the working relationship with the external auditor and the review of IT general controls and application controls. Assumptions: jurisdiction, sector, system names and the audit charter are not specified and are made for teaching only.

Context

The organization has a chief audit executive, three internal auditors, an IT audit lead and a data analytics lead. An external auditor reports each year on the financial statements and relies in part on internal audit work. Audited systems include a general ledger, a payroll system and a shared file store for workpapers. Audit committee members receive quarterly reports on findings. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to give reliable assurance to the board and audit committee, keep auditors independent, protect audit evidence and data, and drive timely remediation of weaknesses. The assets in scope are audit workpapers, system data populations, IT access rights, audit reports, the findings register and the reputation of the audit function. Stakeholders include the chief audit executive, the audit committee, managers of audited areas, the external auditor, regulators where a rule applies, staff whose work is tested, and shareholders or lenders who rely on the opinion. Each risk has one owner role. The chief audit executive keeps the register current and reports to the audit committee each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H06 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H03
3 Possible Likelihood 3, impact 3, score 9, medium: H07 Likelihood 3, impact 4, score 12, high: H04 H08 Likelihood 3, impact 5, score 15, high: H05
2 Unlikely Likelihood 2, impact 5, score 10, high: H02
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H06
2 Unlikely Likelihood 2, impact 2, score 4, low: H07 Likelihood 2, impact 3, score 6, medium: H01 H02 H03 H04 H08 Likelihood 2, impact 4, score 8, medium: H05
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Insufficient or unreliable audit evidence 16 High 6 Medium Chief audit executive
H02 Auditor independence and conflicts of interest 10 High 6 Medium Compliance officer
H03 Weak access controls and segregation of duties in audited systems 20 Critical 6 Medium IT audit lead
H04 Incomplete or altered data populations 12 High 6 Medium Data analytics lead
H05 Fraud missed by audit procedures 15 High 8 Medium Head of internal audit
H06 Audit findings not remediated on time 12 High 6 Medium Internal audit manager
H07 Management estimates and forecasts accepted without challenge 9 Medium 4 Low Senior auditor, estimates review
H08 Audit data exposed through third parties and file sharing 12 High 6 Medium IT manager
H01

Insufficient or unreliable audit evidence

Operational Before 16 After 6

Audit conclusions are drawn from incomplete, outdated or second hand evidence, so a control failure or error is missed or reported wrongly.

Who or what is affected: Audit team, audit committee and report readers

Causes

Tight deadlines, reliance on management summaries and limited time for fieldwork.

Consequences

Incorrect conclusions, missed control failures and reputational harm to the audit function.

Existing controls

  • Workpapers are reviewed by a senior auditor before issue.
  • Sampling follows a documented method agreed at planning.

Control gaps

Evidence is checked for sign off but not tested for completeness at source.

Additional controls

  • Prevent: Require evidence to be obtained directly from source systems with a recorded date and preparer.
  • Detect: Re-perform a sample of key tests through a second reviewer before the report is signed.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Chief audit executive Target: Within 60 days Early warning: Workpapers closed with evidence marked as copied or summarized rather than sourced.
H02

Auditor independence and conflicts of interest

Reputational Before 10 After 6

An auditor has a personal, financial or prior role link to the area being reviewed, or feels pressure to soften a finding, which weakens objectivity.

Who or what is affected: Audit committee, management and shareholders

Causes

Long relationships with managers, reuse of the same audit team and unclear rules on gifts.

Consequences

Loss of objectivity, disciplinary action and an audit opinion that is challenged.

Existing controls

  • Each auditor signs an annual independence declaration.
  • Engagements are assigned by the chief audit executive.

Control gaps

Declarations are collected but not compared with current engagements or the external audit relationship.

Additional controls

  • Prevent: Check each engagement against a register of prior roles and declared interests before fieldwork starts.
  • Respond: Route pressure or complaints to the audit committee chair through a confidential channel.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Compliance officer Target: Within 45 days Early warning: A declared interest linked to an area with an open finding.
H03

Weak access controls and segregation of duties in audited systems

Technology and data Before 20 After 6

Users hold rights that let them create, change and approve transactions, or privileged accounts are shared, so errors and misuse go unseen during audit testing.

Who or what is affected: Finance staff, IT staff, auditors and system owners

Causes

Role creep, shared administrator passwords and small teams with few reviewers.

Consequences

Undetected fraud, unreliable reports and reliance placed on controls that do not work.

Existing controls

  • Users sign in with individual accounts.
  • Privileged access is reviewed once a year by the IT manager.

Control gaps

Access reviews run once a year and do not cover application level rights.

Additional controls

  • Prevent: Remove conflicting role combinations and enforce multi-factor sign in for privileged accounts.
  • Detect: Run a quarterly report of users with conflicting rights and log the outcome in the audit file.
Likelihood 4 x impact 5 before; 2 x 3 after Owner: IT audit lead Target: Within 30 days Early warning: Privileged accounts used outside normal hours or by users not named in the access list.
H04

Incomplete or altered data populations

Technology and data Before 12 After 6

Data extracted for sampling or analytics misses records, is filtered wrongly or changes in transit, so test results describe the wrong population.

Who or what is affected: Audit team, system owners and report readers

Causes

Manual exports, changed system fields and reports that depend on one person.

Consequences

Wrong sample, missed exceptions and rework that delays reports.

Existing controls

  • Record counts are compared with the system total before testing.
  • Extraction scripts are kept with the workpapers.

Control gaps

Completeness is checked for totals but not for the filters applied in queries.

Additional controls

  • Prevent: Agree report parameters with the system owner and record a control total for each extract.
  • Detect: Reconcile extracted totals to the general ledger at each period end.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Data analytics lead Target: Within 60 days Early warning: Population counts that differ from ledger totals by any unexplained amount.
H05

Fraud missed by audit procedures

Financial Before 15 After 8

Collusion, override of controls or falsified documents hide misappropriation, and standard sampling and inquiry do not detect the scheme.

Who or what is affected: Owners, lenders, employees and the audit function

Causes

Trust in long serving staff, pressure on results and sampling that avoids unusual items.

Consequences

Direct loss, restated accounts, legal exposure and loss of confidence.

Existing controls

  • Fraud risk is considered at planning each year.
  • Auditors ask management about known or suspected fraud.

Control gaps

Fraud risk assessments are generic and not refreshed when controls change.

Additional controls

  • Prevent: Include analytics for duplicate payments, round sums and off hours entries in each fraud risk plan.
  • Respond: Escalate any suspicion to the audit committee and legal counsel before further inquiry.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Head of internal audit Target: Within 90 days Early warning: Manual journals posted near period end with no clear business reason.
H06

Audit findings not remediated on time

Legal and compliance Before 12 After 6

Agreed actions are delayed, closed without evidence or accepted by management without a plan, so the same weakness reappears in later periods.

Who or what is affected: Management, board, regulators and the audit team

Causes

Competing priorities, unclear ownership and actions set without cost or time estimates.

Consequences

Repeat findings, weaker governance and penalties where a rule applies.

Existing controls

  • Findings are logged with an owner and due date.
  • Status is reported to the audit committee each quarter.

Control gaps

Closure is accepted on management's word and there is no re-test step.

Additional controls

  • Prevent: Require evidence of completion before any finding is closed and record the test used.
  • Detect: Re-test closed high rated findings within a set period to confirm the fix works.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Internal audit manager Target: Within 45 days Early warning: Actions past their due date without an approved extension.
H07

Management estimates and forecasts accepted without challenge

Strategic Before 9 After 4

Valuations, provisions and forecast assumptions prepared by management are accepted on face value, so balances and disclosures are optimistic.

Who or what is affected: Management, investors, lenders and auditors

Causes

Reliance on a single source, targets linked to pay and weak documentation.

Consequences

Overstated assets or profit, poor decisions and later adjustments.

Existing controls

  • Estimates are reviewed by the finance lead at year end.
  • Key assumptions are documented in the audit file.

Control gaps

Past estimates are not compared with outcomes, so bias goes unseen.

Additional controls

  • Prevent: Require an independent range of estimates and a documented basis for any value outside it.
  • Detect: Compare prior period estimates with actual outcomes and report differences to the audit committee.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Senior auditor, estimates review Target: Within 90 days Early warning: Estimate changes that move in one direction for several periods without new evidence.
H08

Audit data exposed through third parties and file sharing

Supplier Before 12 After 6

Workpapers, personal data and system credentials are shared with outside advisers or stored in file shares without controls, so confidential information is leaked or altered.

Who or what is affected: Audited staff, clients, outside advisers and the audit team

Causes

Email attachments, unmanaged devices and outside advisers with broad access.

Consequences

Data breach, loss of client trust and contract penalties.

Existing controls

  • Workpapers are stored in a restricted audit folder.
  • Third parties sign confidentiality terms before access is granted.

Control gaps

Access logs for the audit folder are not reviewed.

Additional controls

  • Prevent: Use a secure portal with expiry dates for external sharing and remove credentials after each engagement.
  • Respond: Follow a written incident plan that informs the audit committee and counsel within a set time.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: IT manager Target: Within 30 days Early warning: Audit folder downloads by accounts that have left the team.

Rating method and evaluation

Each risk is rated on two five point scales. Likelihood runs from Rare to Almost certain and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25 in one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. Low risks are accepted and watched. Medium risks need routine controls with a named owner. High risks need senior attention and a dated plan. Critical risks need immediate action and reporting to the audit committee. Inherent risk is the score before any controls, and residual risk is the score after existing and added controls. A residual score must never be higher than the inherent score, and where inherent is 10 or more, residual must be lower. Impact is judged on money, time to correct, effect on the audit opinion and harm to trust. An audit risk is never rated down only because it has not yet happened. Ratings are challenged by the audit team and by a reviewer outside the engagement, and they are revisited whenever a monitoring indicator reaches its threshold. Specialist review is needed for any formal assurance opinion.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Open audit findings past their due date without an approved extension.Escalate to the chief audit executive when any finding is more than 30 days late, and to the audit committee after 60 days.
Users holding conflicting access rights in audited systems.Escalate to the IT audit lead at once, and remove one right within a week.
Engagement team members with a declared interest in the area under review.Escalate to the compliance officer before fieldwork starts, and reassign the member if the link is not cleared.
Population totals that differ from ledger totals by an unexplained amount.Escalate to the data analytics lead the same day, and hold conclusions until the difference is explained.
Manual journals posted in the last three days of a period without a named business reason.Escalate to the head of internal audit when more than one is found, and to the audit committee if the pattern continues.

Contingency arrangements

If a serious event occurs, such as a suspected fraud, a confirmed breach of audit data or an opinion that must be changed, the chief audit executive stops fieldwork on the affected area and preserves workpapers. The IT audit lead isolates affected accounts and restores data from the latest tested backup. The audit committee chair and legal counsel are informed at once, and contact with the external auditor follows the agreed protocol for the relevant jurisdiction. Management is told what is needed early and plainly, and a dated plan is agreed before any report is reissued.

Prioritized action plan

  1. Run a conflicts check against all open engagements before fieldwork begins, owner compliance officer, within 45 days.
  2. Remove conflicting access rights and review privileged accounts, owner IT audit lead, within 30 days.
  3. Add analytics for duplicate payments and late journals to the fraud risk plan, owner head of internal audit, within 90 days.
  4. Reconcile every audit population to source totals and record the filters used, owner data analytics lead, within 60 days.
  5. Require evidence before closing any finding and re-test high rated items, owner internal audit manager, within 45 days.

Conclusion

Reliable audit assurance rests on a few habits: independence checks before each engagement, access reviews on a set cycle, populations tied back to source totals, evidence that is sourced and dated, and a findings process that closes only on proof. The highest scores sit with access control and missed fraud, and each has actions that lower the residual score. Treat this register as a living record, review it on the stated cycle, and seek qualified professional advice for any real assurance, legal or regulatory question.

Assumptions and limitations

Assumptions

  • The organization has an internal audit function, uses an external auditor each year and runs accounting and HR systems that are in audit scope.
  • Staff are trained professionals who work on managed computers with individual sign in.
  • Jurisdiction, sector and system names are not specified, so legal duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real audit.
  • Auditing standards, reporting duties and data protection rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not audit, accounting, legal or IT security advice.

Related frameworks to study

  • Risk based audit planning approach
  • Three lines model of risk ownership
  • Internal control framework with monitoring component
  • IT general controls review approach
  • Fraud risk assessment with data analytics

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Internal, External and IT Audit course Read the best practices for this course

More Finance risk assessments

Hourly Active: 39,499 Learners