How Do You Audit Enterprise Risk Management?

Norman Marks has been writing about world-class internal auditing and enterprise risk management for many years, and his books and blogs have been very well received. Now he has taken on what he thinks may have been his greatest challenge, explaining how people should go about auditing enterprise risk management. Before you can audit risk management, you have to know what effective risk management is - which he spends the first part of the book explaining. Only then does he detail how an internal audit executive might design one or, more likely, a combination of suitable, risk-based audit engagements. The end product is an opinion that the internal audit executive can share with the board and top management. The goal is to provide assurance, advice, and insight on the effectiveness of risk management processes that are integrated into objective-setting, performance management, and decision-making. It's not to find fault. Most organizations are on a journey to fully mature or effective risk management. Instead, it's about helping them understand where they are on that journey and how they can enhance their processes and practices. It's about helping them have the enterprise risk management that will help them make the informed and intelligent decisions, taking the right level of the right risks, for success. The book includes a detailed risk management maturity model that can be used to assess where an organization's processes and practices lie, and how they can be improved.