Fundamentals of Risk Management

Risk assurance
Risk assurance is an important component of the overall risk management process. 
The audit committee will seek assurance that all of the significant risks are being 
adequately managed and that all of the critical controls are effective and that they 
have been efficiently implemented.
There are often discussions at audit committees about ‘how seriously a particular 
department takes risk management and internal control’. The risk manager and the 
internal auditor will undoubtedly be able to offer an opinion. However, what the 
audit committee will require is an objective evaluation of the performance of that 
department. This objective evaluation of the risk culture within the department will 

---

Risk assurance
406
form the main basis of assurance for the audit committee. There are other sources
of assurance available to the audit committee and these are set out in Table 34.2. 
Subject to the nature of the organization, the audit committee may depend on some 
or all of these sources of assurance. Risk assurance is also available from the external 
auditors, although this may be limited to validation of the accounting processes and 
financial performance.
Assurance will also be required in relation to the risk management activities them-
selves. The review and monitoring stage of the risk management process is usually 
represented as an information and experience loop that provides feedback to the 
beginning of the process. When considering the review and monitoring activities that 
need to be undertaken, the following stages should be borne in mind:
●
●
review of the process as it operates in the organization;
●
●
review of the standards of risk control in force;
●
●
review of the level of success in reducing risk exposures;
●
●
review of the level of success in achieving business objectives;
●
●
review of why a high-risk strategy, project or operation was successful;
●
●
delivery of risk assurance across this whole range of activities.
When a company plans to borrow more money from the bank, it may be asked to 
demonstrate how the board obtains assurance that the management of significant 
risks is satisfactory. The sources of assurance available might include:
●
●
evaluation of the risk culture of the organization;
●
●
quality of audit reports produced by internal audit;
●
●
quality of reports produced by the various departments;
●
●
overall business success of individual departments.
The company may decide that the reports from internal audit and the quality of 
reports from departments will be the basis of risk assurance. The company can also