Who is this article for?

Users who need to plan Risks.

No special access or permissions are required.

You can risk-assess the audit universe in respect of a chosen planning period, in order to determine and maintain your Audit Schedule or Plan.

1. Understanding planning scenarios and periods

More than one planning scenario can be set up covering the same date range, and some or all of any planning period can be used to make the audit plan for that date range.

Planning Risk factors can be defined, assessed and configured to match necessary scoring rules. They are used to record global risks that apply to large parts of the Audit Universe. Using these Planning Risks users can give a risk score to each Entity-Process. These scores or assessments are entered within a Planning Period to allow for effective Audit Planning.

2. Registering planning risks

Planning risks are registered against each Entity and each Process with the following attributes:

• Name – give the planning risk a name
• Order – the order to display the planning risk on the data grid
• Description – a description for the planning risk (rich text format)
• Guidance – can be used to provide additional information needed to complete the work, expected results or standards to which the work refers
• Active – select whether the planning risk is active or not; only active planning risks can participate in planning periods
• Category – segmentation
• Entity Types – associate a Planning Risk with certain types of Entity Types (segmentation)
• Process Types – associate a Planning Risk with certain types of Process Types (segmentation)
• Weight – Weight associated to the item during roll-ups

The planning risk factors can be weighted relative to each other and criteria can be set such that different risk factors are assessed in respect of different subsets of the universe. For example, you may define some risk factors that apply to your IT Projects and others for Branches or Locations.

3. Working with Entity and Process Types

Planning Risks can be associated with Entities of a certain type. If a Planning Risk does not have an entity type it will be associated with all Entities that also have no type set.

If a Planning Risk has a type set it will only be associated with Entities of the same type. This association dictates which Entity-Process will require a risk assessment within an active planning period.

An Entity can be associated with one entity type while a Planning Risk can be associated with more than one entity type.

The above applies in the same way to processes. Entity and Process types can be created within the Admin > Segmentation screen.

4. Applying Planning Risk weightings

A Planning Risk may have a greater significance to the Audit Universe and to reflect this they have a weighting. This weighting will affect the calculated score for the Planning Risks assessment within a Planning Period. Effectively a higher weighting will result in the planning risk assessment having a higher score.