The Anatomy of a Perfect Risk Statement

How to write
Effective Risk Statements
for Your Audit Workpapers?

https://www.linkedin.com/in/chinmaykulkarni22/
 Why Risk
Statements Matter?
Fundamental part of an audit program

Helps in addressing the core issue

Risk statement provide a means to

evaluate existing controls

Aids in planning risk treatment options

Helps to determine the audit approach

https://www.linkedin.com/in/chinmaykulkarni22/
 Core components
of a Risk Statement
Risk: Effect of uncertainty on organization
objectives.

Cause: Reason for the uncertainty

Event: Occurrence of actions because of

several causes

Consequences: Effects of the event on

business goals

https://www.linkedin.com/in/chinmaykulkarni22/
 How to write a
Risk Statement?
An effective risk statement should answer

What could happen?

How it could happen?

Why should we care?

https://www.linkedin.com/in/chinmaykulkarni22/
 3 Pillars of a
Risk Statement
An effective risk statement consists of

Cause

Event

Consequences

https://www.linkedin.com/in/chinmaykulkarni22/
 How to write a
Risk Statement?

[Event] because of [cause] might

lead to [consequences]

Developers have inappropriate privileges allowing

them to promote changes to production
environment without prior approval might lead to
undetected errors and violation of segregation of
duties principle resulting in invalid data/fraud.

https://www.linkedin.com/in/chinmaykulkarni22/
Save it for later

https://www.linkedin.com/in/chinmaykulkarni22/
 Connect with me
to learn more about

ITGC Testing

Certified Information Systems Auditor (CISA)

ISO 27001 ISMS

ISO 27701 PIMS

Data Privacy

IT Auditing

Risk Management

https://www.linkedin.com/in/chinmaykulkarni22/