Not Reporting Risks as Audit Issues – Will perform Advisory Instead?

One response

1. It sounds like you’re raising an important point about the distinction between Audit findings and advisory recommendations when it comes to risk reporting. In my view, it is critical to clearly define the roles and responsibilities of Audit and advisory functions within an organization.

   Not reporting risks as Audit issues might be a strategic decision in some contexts, especially if the organization sees value in providing advisory support to address risks proactively rather than just documenting them as issues. This approach can foster a more collaborative environment where teams feel supported in managing risks before they escalate.

   However, it is essential to maintain transparency and ensure that all significant risks are documented and communicated effectively. Audit functions serve a vital purpose in providing assurance to stakeholders that risks are being monitored and managed appropriately. If risks are not reported as audit issues, there needs to be a clear process for how these risks will be tracked and managed, and how findings from advisory work will be communicated back to leadership and relevant stakeholders.

   Ultimately, it’s about finding the right balance between proactive risk management and fulfilling the audit function’s role in accountability and oversight. What are your thoughts on how organizations can effectively navigate this balance?

   Log in to Reply