Skip to main content

Enterprise Risk, Control & Assurance

How do enterprise risk, internal control and assurance differ?

Enterprise risk management identifies and treats the risks to objectives and reports them to the board. Internal control is the narrower set of processes giving reasonable assurance over reporting, operations and compliance. Assurance is the independent check that those controls exist and work, delivered by internal audit or an external auditor.

What evidence does an auditor usually ask for?

An auditor asks for evidence that a control was designed properly and operated throughout the period: the documented procedure, a population of the events it applies to, a sample showing it ran, the record of who performed and who reviewed it, and the exceptions with their resolution. A policy on its own evidences design, not operation.

Most-consulted titles in this category, of 11289

Wider context and related disciplines: risk control and compliance.

!