Audit Planning Guidance 3 b

Risk Factor Component Rating ( 1-Low risk, 2-Medium Risk, 3-High Risk)
Risk Factor

Control Environment

Components
Attitude & Integrity
of management
Constraints

1.
2.
3.
1.
2.

Policies & Procedures

Competence of staf
Control Automation

Management
Interest/ Concern
Comfort with
Operations
Management

Complexity of
operations
Experience of
Management
Quality and level of
staffing

3.
1.
2.
3.
1.
2.
3.
1.
2.
3.
1.
2.
3.
1.
2.
3.
1.
2.
3.
1.
2.

ALTUM Training & Consulting

Rating Details
Good integrity and right attitude to control
Good integrity but bad attitude to controls
Bad integrity and bad attitude
No constraint exist/ constraint exist and measures
put in place
Significant constraints exist and measures being
worked on
Major constraints exist but no measures put in place
Documented policies & procedure exist and updated
Documented policies & procedure exist but not
updated regularly
No clear policies or procedures
Well experienced
Moderately experienced
Inexperienced
Major controls automated and working well
Controls automated but not functioning well
Not well integrated and mostly manual
No Concern
Mild Concern
Serious Concern
No complexity involved
Minor complexity
Complex and technical
Executors are well versed in the operations
Executors are moderately versed in the operations
Executors have very little experience in operations
Quality and number are optimal for the required
performance
Quality and number are just adequate for

Audit Planning Guidance 3 b

Risk Factor

Asset
Sensitivity/Importan
ce

Components

Mobility and
convertibility
Prone to fraud

New business
sys/process & Policies
Internal Changes
Reorganization

Key Personnel
Changes
New Product
New Regulation / Law
External Changes
Changes in Economic
& Political
Environment
Impact & Materiality
Size
ALTUM Training & Consulting

Rating Details
performance
3. Quality and number lower than necessary for required
performance.
1. Not mobile and very difficult to convert
2. Relative mobility and relatively easy to convert
3. Highly mobile and easily convertible
1. No fraud history and not likely to happen
2. Minor frauds happened and likely to recur
3. Major frauds with significant efect have occurred in the
past
1. No significant changes
2. Minor changes
3. Significant changes
1. No significant changes has taken place nor expected to
happen
2. Some significant changes have occurred / expected to
occur
3. Process transferred to /expected to be transferred
another department
1. No changes in key personnel
2. Minor changes in key personnel
3. Significant/major changes in key personnel
1. Process and procedure well established
2. Process and procedure are relatively new
3. New process or procedure
1. No impact on operation
2. Minor impact on operation
3. Major impact on operation
1. No impact on the processes
2. Minor impact on processes
3. Significant efect on processes
1. Not a key role process and has no strategic significance.
2. Not a Key role process but has significant impact

Audit Planning Guidance 3 b

Risk Factor

Components

Rating Details
3. Key role process of strategic importance

External audit finding

1.
2.
3.
1.
2.
3.

Audit Interest/
Concern
Last time audited

ALTUM Training & Consulting

Low risk/ no issues raised about the process

Medium risk issues raised about the process
High risk issues raised about the process
Internal Audit performed 2years ago or less
Internal Audit performed more than 2years ago
Internal Audit never performed.