Auditing risk culture

Do internal auditors need to be trained to conduct a risk culture audit?

It requires a larger number of internal auditors to be trained in conducting surface-level cultural risk assessments across the audit universe, as well as a team of specialist internal auditors to conduct deep dive risk culture audits in high-risk parts of the business

What is a risk culture audit?

It presents the internal auditor with information so they can decide to perform a risk culture audit themselves, or be in a position to discuss such audits in an informed way with internal functions (such as ERM) or external providers Risk culture and its context

The role of internal audit Risk culture model Auditing culture in practice

Why do Australian businesses need a risk culture?

So it is not surprising that there is a strong desire throughout Australian businesses to measure and evaluate a company’s risk culture, so that action can be taken to reduce potentially major exposure

Risk culture refers to the culture of the organisation, or ‘the way things are done here’ in relation to risk taking