Risk-based internal audit methodology at a retail business in Cape Town

Abstract

In today's corporate environment, organisations are exposed to some level of risk, which can prevent them from achieving their goals and objectives if the risk materialise. Organisations put risk management processes in place to help them mitigate risks, which consequently assists in achieving their objectives. Internal audit functions can assist management in this process by using a risk-based approach, which could also eliminate inefficiencies in the audit process. However, an audit methodology needs to be followed for the internal audit function to be effective in this process. As a result, internal audit methodologies were developed to emphasise a risk-based approach. Risk-based internal auditing is an internal audit methodology that ensures alignment of the internal audit activities with the organisation’s strategies, business objectives, associated risks, and risk management framework. Therefore, the risk-based internal auditing methodology is deemed necessary to ensure the effectiveness and efficiency of internal audit practice. The study focused on understanding the internal audit methodology followed at a retail business in Cape Town, as a case study. The study aimed to explore the role of risk-based internal auditing methodology as a driver of the effectiveness of the internal audit function. This was accomplished through conducting semi-structured interviews and online surveys with internal auditors, audit managers, and the CAE. This research study established the extent that risk-based internal auditing methodology contributes to the effectiveness of the internal audit function within the selected retail business. In addition, drivers of internal audit effectiveness were identified with a risk-based internal auditing approach considered as the most important by respondents, and ‘internal audit function management support’, as the least important. This research study additionally clarified the various factors affecting risk-based internal auditing, including its limitations. It is important to note that although limitations are linked to the RBIA approach, RBIA's impact on internal audit effectiveness and the benefits of the methodology surpass its limitations.