Changes in the principles of auditing - Specific reference to risk-based approach
The previous edition of ISO 19011:2011 had suggested taking into consideration the adoption of a risk-based approach, but it (please refer to clause 5.3.4 - ISO 19011:2011) provided limited guidelines on the matter. ISO 19011:2018 standard document has placed an improved and enhanced focus. Now adoption of risk-based approach will essentially be a critical determinant while planning, conducting and reporting of the audit. It has added a new principle 'the risk-based approach' that provide guidelines to auditors to consider risks and opportunities during auditing at every phase while planning, conducting and reporting. Clause 5.3 of ISO 19011:2018 standard document specifies guidelines for determining and evaluating audit programme risks and opportunities. It is better for an auditor to understand risks and opportunities related to the context of the auditee that may affect achievement of audit objectives. The people, involved in managing an audit, should identify and consider (i) the associated risks and opportunities, and (ii) resource requirements, when developing an audit programme. These identified risks and opportunities, and resource requirements should be communicated to the audit client so that these are addressed suitably.
Risks may be associated with: (i) planning, (ii) resources, (iii) selection of auditor(s) for the audit, (iv) communication, (v) implementation, (vi) control of documented information, (vii) monitoring the audit programme, (viii) reviewing the audit programme, (ix) improving the audit programme, (x) availability of auditee, (xi) cooperation (and coordination) of auditee, and (xii) availability of evidence to be sampled.
Opportunities may be available that can improve the audit programme. Such opportunities may relate to: (i) multiple audits in a single visit, (ii) minimizing time and distances involved in travelling of audit team members, (iii) availability of competent audit team members, and (iv) aligning audit dates with the availability of relevant key auditee.
The application of risk-based approach in auditing management systems will serve as a tool for risk prevention. It will optimize efficiency and effectiveness of the audit process and audit outcome.
Thus, the new standard (ISO 19011:2018) places improved emphasis on risks, opportunities and auditor competence.
Best wishes,
Keshav Ram Singhal
No comments:
Post a Comment