Tutorial 3a: Defining Risk Factors

Menu item 3, Risk Assessment Menu, on the AMP Main Menu is used to define the risk models and evaluate the audit universe using the risk models. Figures 6 and 7 show the risk models we will use for the two families.

Risk factors are criteria used for setting audit priorities for audit units. There are many sources to help you identify possible risk factors, including the AMP Reference Manual, the case studies included with AMP, and professional literature.

Note: It is very important that the risk model reflect management concerns, if management is expected to accept the results of the prioritization process. Many AMP users get management personnel involved in the risk factor identification and assessment process using surveys, structured interviews or informal discussions.

The manager in charge of implementing AMP in Example Inc. has identified the risk factors listed in Figures 6 and 7 as being an appropriate basis for prioritizing audit activities.

Figures 6 and 7 list the risk models selected for DIV1 and DIV2 respectively. Each figure contains the risk factor category names and their chosen weights indicating the categories' relative importance to other categories, followed by the categories' specific risk factors and chosen weights.

Figure 6: Risk Model for Division 1

Figure 7: Risk Model for Division 2

Let's go to the Risk Factor Maintenance Menu and record the risk models.

Select menu item 3 from AMP Main Menu and then menu item 1 from the Risk Assessment Menu.

The first step in recording a risk model is defining the risk factor categories.

Select menu item 1, 3.1.1 Maintain Risk Factor Categories, and us the DIV1 file as input. Note that two categories, SIZE and AUDIT RECENCY have already been defined. These were automatically created with the file. Use the ADD command to add the other two categories shown in Figure 6, MANAGEMENT and EXTERNAL.

We are now ready to record the specific risk factors for DIV!.

SAVE and QUIT from the Maintain Risk Factor Category screen and select menu item 2, 3.1.2 Maintain Specific Risk Factors, using the DIV1 file again. Select the category, MANAGEMENT, by entering its sequence number and pressing ENTER. The specific risk factors for this category, as shown in Figure 6, can now be recorded using the ADD command. Repeat this process for the category, EXTERNAL, and then QUIT back to the Risk Factory Management Menu.

Now that the Risk Factors and their Categories are defined, we can evaluate their importance relative to one another. AMP provides several ways of rating risk factors. The tutorial for Risk Factor Maintenance demonstrates these features. In this case study, we will use the direct assessment approach on the assumption that we have previously determined relative importance scores for the risk factors.

Select menu item 3, 3.1.3 Evaluate Risk Factors. Menu items 3, 3.1.3.3 Evaluate Risk Factor Categories - Directly, and 6, 3.1.3.6 Evaluate Specific Risk Factors - Directly, on this menu are used to record the chosen weights for the categories and risk factors, respectively. Record the chosen weights as shown in Figure 6 for all the categories and risk factors in the DIV1 file.

Now repeat the 4 steps followed above for the DIV2 file, using the data in Figure 7. After you have completed recording this information, the risk model is complete.

By returning to the Risk Factor Maintenance Menu, we can print a report using menu item 4, 3.1.4 Print Risk Factor Reports, followed by menu item 1, 3.1.4.1 Print Risk Factors, showing the risk factors and their global specific factor weights for DIV1 and DIV2. Use the SAVE command at the Record Selection screen to proceed with the report.

This brings us to the end of this tutorial. We have skipped some sections of AMP in the interest of reducing the time requirements of the tutorial. We encourage you to explore the other features and experiment, perhaps by applying AMP to your own data.