Risk Register Example for Internal Audits

Likelihood Severity of Chance of

Description & Action Closure
of Occur- Potential
rence
Non-
Problem Detection
Risk Level
(3x3 - Max

Issue Taken Due Date Action Verification & (L,M,H) 27)

(L,M,H) (L,M,H)
Date Completed Close Date
Can't get internal audits completed, or completed timely Change internal priorities, re-allocate resources, or
outsource/subcontract to get audits done. M H L 6
Can't get internal audits completed, or completed timely Train more internal auditors, or outsource/subcontract to get
audits done. H H L 9
External auditor has written a finding against clause 9.2 The internal audit process is not effective. Improve competency
for our internal audits of internal auditors or outsource/subcontract audits. Increase M H M 12
management oversight of internal audits.
High turnover of internal auditors, requiring constant Identify new auditors, send auditors to training, or
training of new auditors. outsource/subcontract audits. H H L 9
Internal auditors aren't effective Auditor selection process is not effective. Selected people don't
want to be auditors, or aren't capable of being good auditors.
Auditor training and development is not effective. Improve
auditor selection, training and development, or
H H M 18
outsource/subcontract audits.

Internal auditors can't keep up with changing customer
specific requirements, changes to the standards, and
auditor competency requirements.
Auditor selection process is not effective. Selected people don't
want to be auditors, or aren't capable of being good auditors.
Auditor training and development is not effective. Improve
auditor selection, training and development, or
H H M 18
outsource/subcontract audits.

Auditors afraid or reluctant to write findings, so issues
aren't identified for correction
It takes too long to complete internal audits and takes a
lot of company resources to complete.
Poor management support of the audit process. Auditor
selection and training process is not effective. Improve auditor
selection, training and development, or outsource/subcontract H H H 27
audits.
Allocate adequate resources, or outsource/subcontract audits to
competent personnel who can perform audits more efficiently
and effectively, while reducing time of internal resources. H M M 12

There are resource constraints to perform audits and be Allocate adequate resources, or outsource/subcontract audits to
audited, so audits are pencil-whipped or not thoroughly competent personnel who can perform audits more efficiently
conducted. Not getting value from audits. and effectively, while reducing time of internal resources. H M M 12

Internal auditors do not have the knowledge or
experience to help the company improve. Auditors have
limited experience or benchmarking to help identify
opportunities for improvement.
Auditor selection process is not effective. Selected people don't
want to be auditors, or aren't capable of being good auditors.
Auditor training and development is not effective. Improve
auditor selection, training and development, or
H H M 18
outsource/subcontract audits.

0
0
0
0
0
Criteria for action - Risk score >12 mandatory action
www.simpleque.com