Module 4

SECTION 3: APPENDIX
This section contains few checklist that might be useful for IS auditors while performing audit of
different areas discussed in this module. Please note that contents of this section are for
information and may not be complete in all respects. Auditors must pick and choose the different
sections from these checklist while conducting audit and modify suitably as per the requirements
and scope of audit.

1. Audit Checklist: Risk Management Process

Below are some of the suggested criteria and procedures for conducting an audit of risk
management. The auditor's primary role is to ascertain whether the methods and procedures used
were appropriate and conform to the policies and guidelines which make up the organization’s
approach to risk management. The auditor's secondary role is to ensure that any identified
deficiencies are dealt with and that follow-ups are made.

Sl. Section Control Objective Audit Procedure

No.
1 Risk Management
framework
2 Risk Identification
Organization must have a Review Risk policies for common
risk management policy terminology, Risk response
and framework that options and definition of risk and
guides users in risk control owners
identification and Understand risk management
assessment process and framework.
Interview managers that they
understand the terminology,
process and framework.
Review risk register and its
updating process.
Interview senior management to
understand risk appetite and risk
tolerance levels.
Management understands Check whether all managers are
the risk identification aware of the key risks to the
concept and has identified organization and / or their
key risks. function
Assess the depth of the
manager's understanding of the
risk identification process based
on his or her awareness.

1

3 Risk Mitigation Management has
performed valid risk
assessments.
Management has
selected and
implemented cost-
effective risk control
measures.
As a result of
implementing control
measures, the overall risk
to the organization has
declined.
4 Risk Monitoring Investigate incidents,
changes, acquisitions,
Projects and verify that
the management has
reviewed risk associated
with root cause and risk
register is updated.
5 Risk register Review risk register to
contain risk identification,
Risk response risk owner,
controls implemented.
6 Risk review Ensure risk review
process is in place and
Section 3
Verify that managers have
assessed the key risks to the
organization.
Assess the completeness and
accuracy of the risk assessment.
Verify that management has
documented risk assessments for
each of the significant risks
identified.
Verify that management has
developed a series of risk-
minimization, cost-effective
options.
Assess whether the control
measures introduced have
managed the threat from the
threats, as intended.
Review the root cause of incident
and ensure updating of risk
register
Review changes and acquisitions
and their linkage to risk registers
during assessment of impact due
to change.
Review project risk management
process.
Verify that there is a clear and
comprehensive procedure for
recording, filing, maintaining and
reporting on data sources, risk
register
Determine whether procedures
associated with risk management
activities are carried out
Assess whether all occurrences
of risk-related incidents have
been reported.
Review risk register for updating
after risk review.
Module 4

risk review happens Interview risk owners to confirm

periodically for they have followed the review
reassessment of identified process.
risks and assessment of
new risks
7 Control Controls should be Check controls selected and
identification identified based on the implemented are against
risk assessment. The cost identified risk.
benefit analysis for Review the cost-benefit analysis
selected controls must be (qualitative or quantitative) for
performed. implemented controls against
total impact/exposure of risk