External Risk Audit vs Internal Risk Audit

What is External Risk Audit

External risk auditing is an independent review and assessment of the risks, controls and safeguards in an organisation by someone from outside the company. It involves an identification of the risks within given frames of reference (the whole company, a given area of activity, a given department or location) and advice on managing those risks in terms of a risk assessment.


The first argument in favour of an external risk audit

1. The ‘fresh pair of eyes’ effect that applies to the use of any external consultant. It seems evident that the existing management is unaware of all of the risks faced by the company and a new person coming in might identify new risks.


2. An external person would take responsibility away from the squabbling directors who are unlikely to work together on it. There is obviously enough tension and discord among board members to threaten any audit where collaboration would be needed to provide information and implement any recommendations.


3. An external risk auditor would provide an unbiased view of the causes of poor risk management and hence be able to give advice on where things can be improved. This will be important when recommending changes to systems to account for risks as it may impact some departments more than others.


4. In some countries, (i.e. under Sarbanes Oxley), an element of independent assessment is necessary for compliance. In any event, encouraging independent scrutiny is good practice and reassures external stakeholders (such as shareholders) in the same way that an external financial audit does. At a time when the effectiveness of internal risk controls have been questioned, investor confidence is especially important.



*************