The Risk Register That Nobody Owns
A Bulgarian state agency has a risk register with 47 entries, all rated 'low' or 'medium'. The register was last updated 14 months ago by a junior expert in the planning directorate who has since left. Department heads say they have never seen it. The agency's main risks in reality are: dependence on a single IT supplier for its case-management system, a statutory deadline for processing citizen applications that is missed in about 8% of cases, and a pending change in the financing model that could cut its budget by 20%. The executive director asks internal audit to 'confirm the risk register is adequate' so he can report to the minister. Your audit plan for the year does not include a risk-management assurance engagement; it includes three compliance engagements chosen last December.
1. How should you respond to the executive director's request, and what should the engagement actually conclude?
Read the worked answer
Distinguish three different requests that are being blended: (1) a request for assurance on risk management, (2) a request for someone to fix the register, and (3) a request for a comfort letter to the minister. Only (1) is an audit product. Internal audit may provide assurance on the risk-management process; it must not own or operate the register, because that would transfer management responsibility and destroy the ability to audit it later.
On scope: an assurance engagement on risk management is not in the approved plan. The plan is risk-based and the plan itself is now demonstrably out of date, since the agency's real exposures (supplier concentration, statutory deadline failure, financing change) are absent from the register. The correct move is to bring a plan revision to the audit committee, with the risk-management engagement added and its rationale documented, rather than quietly accepting an assignment from the director. If urgency justifies interim work, the committee can approve a limited-scope engagement.
On the conclusion: the evidence already visible points to a finding that the risk-management process is not effective. Indicators: no updates in 14 months, no evidence of ownership by department heads, ratings that do not reflect known exposures, no linkage to objectives, no treatment plans. The report should say the process is not functioning, describe the consequences (the minister would be receiving an unreliable picture), and recommend that management re-establish ownership and re-run the assessment. It must not certify the register as adequate.
2. Draft the core structure of the findings for this engagement, showing how you would link criteria, condition, cause, effect and recommendation for the three real risks.
Read the worked answer
Use one finding per significant exposure, each with criteria-condition-cause-effect-recommendation, and keep the risk-register weakness as a cross-cutting finding rather than repeating it three times.
Finding 1 - Supplier concentration. Criteria: the agency's own risk-management methodology requires identification of dependency risks and continuity arrangements. Condition: the case-management system is supplied and maintained by one provider; no documented exit or continuity plan was seen. Cause: no risk owner for IT dependency; register not updated. Effect: an outage or supplier failure would halt statutory case processing. Recommendation: assign an owner, document a continuity and exit plan, and add the risk to the register with a rating reflecting impact.
Finding 2 - Statutory deadline failures. Criteria: statutory processing deadlines and the agency's service standards. Condition: about 8% of applications miss the deadline. Cause: not analysed; no root-cause review; capacity and workflow not linked to risk. Effect: citizen detriment, complaints, possible sanctions. Recommendation: root-cause analysis, monitoring indicator, corrective action plan.
Finding 3 - Financing model change. Criteria: planning and risk methodology should reflect significant external change. Condition: a potential 20% budget reduction is not in the register. Cause: register stale, no environmental scanning. Effect: no contingency planning; risk of unplanned service reduction. Recommendation: scenario and contingency planning owned by the executive.
Cross-cutting finding: the register is not maintained, not owned and not used; ratings are not evidence-based. The overall opinion should be that risk management is not effective, with the three exposures named as evidence.