Audit & Risk Presentation Overview of Risk

giovanna-bartolotta

Published 2025-06-23 · 37 slides · 0 views

↓ Download

Audit & Risk Presentation Overview of Risk

Audit & Risk Presentation Overview of Risk - slide 1 of 37

Audit & Risk Presentation Overview of Risk - slide 2 of 37

Audit & Risk Presentation Overview of Risk - slide 3 of 37

Audit & Risk Presentation Overview of Risk - slide 4 of 37

Audit & Risk Presentation Overview of Risk - slide 5 of 37

Audit & Risk Presentation Overview of Risk - slide 6 of 37

Audit & Risk Presentation Overview of Risk - slide 7 of 37

Audit & Risk Presentation Overview of Risk - slide 8 of 37

Audit & Risk Presentation Overview of Risk - slide 9 of 37

Audit & Risk Presentation Overview of Risk - slide 10 of 37

Audit & Risk Presentation Overview of Risk - slide 11 of 37

Audit & Risk Presentation Overview of Risk - slide 12 of 37

Audit & Risk Presentation Overview of Risk - slide 13 of 37

Audit & Risk Presentation Overview of Risk - slide 14 of 37

Audit & Risk Presentation Overview of Risk - slide 15 of 37

Audit & Risk Presentation Overview of Risk - slide 16 of 37

Audit & Risk Presentation Overview of Risk - slide 17 of 37

Audit & Risk Presentation Overview of Risk - slide 18 of 37

Audit & Risk Presentation Overview of Risk - slide 19 of 37

Audit & Risk Presentation Overview of Risk - slide 20 of 37

Audit & Risk Presentation Overview of Risk - slide 21 of 37

Audit & Risk Presentation Overview of Risk - slide 22 of 37

Audit & Risk Presentation Overview of Risk - slide 23 of 37

Audit & Risk Presentation Overview of Risk - slide 24 of 37

Audit & Risk Presentation Overview of Risk - slide 25 of 37

Audit & Risk Presentation Overview of Risk - slide 26 of 37

Audit & Risk Presentation Overview of Risk - slide 27 of 37

Audit & Risk Presentation Overview of Risk - slide 28 of 37

Audit & Risk Presentation Overview of Risk - slide 29 of 37

Audit & Risk Presentation Overview of Risk - slide 30 of 37

Audit & Risk Presentation Overview of Risk - slide 31 of 37

Audit & Risk Presentation Overview of Risk - slide 32 of 37

Audit & Risk Presentation Overview of Risk - slide 33 of 37

Audit & Risk Presentation Overview of Risk - slide 34 of 37

Audit & Risk Presentation Overview of Risk - slide 35 of 37

Audit & Risk Presentation Overview of Risk - slide 36 of 37

Audit & Risk Presentation Overview of Risk - slide 37 of 37

Description

Audit Risk Presentation Overview of Risk Management Internal Audit Framework KCPLs Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit

Download this presentation From Below

"Audit & Risk Presentation Overview of Risk" is the property of its rightful owner. Permission is granted to download and print the materials on this website for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.

Presentation Transcript

Audit & Risk Presentation

Overview of Risk Management & Internal Audit Framework

KCPL’s Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit assurance on controls

KCPL’s Risk Management Framework Information Security Management
Risk Based approach
Follows ISO 27001:2005 standard
Information security governance
Business continuity
Technology dimension
Operational risk management and Surveillance
Identify the critical operational processes and risks
associated with them.
Preparation of Risk register.
Document Controls ( Severity of control depends on the
risk appetite)
Compliance requirements and reports to the regulator
Fraud detection and control
Financial Risk Management
Accounting and financial controls and reporting.
Statutory and Regulatory requirements and fulfillment
Revenue and cost assurance
Fund Management/ Treasury operations Internal audit assurance

To ensure established controls to
mitigate identified risks, are actually
working.

To report non adherence to
established controls.

Suggest action plans for correction

Ensure the implementation of
suggested action plans

KCPL’s Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit assurance on controls

KCPL’s Information Security Management KCPL Information Security Management System Framework

KCPL’s Information Security Management

Information Security – Risk Assessment process

Information Security – Internal audit execution Information security internal audit is – Risk based and is conducted by taking the following into consideration

Prepare the audit schedule.

Prepare the audit agenda with the controls to be tested

Conduct the internal audit as per the agreed scope and risk register

Prepare the working papers and submit the report for management comments.

Identify actions plans to improve Information security management

Information Security management - Templates IF/ISMS/01.2/Ver. 1.1
Audit Report & Checklist Auditee Signature Auditor Signature

Information Security management - Templates

KCPL’s Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit assurance on controls

KCPL’s Financial Risk Management Accounting of all financial transactions including accruals
- Billing to the client – Revenue accounting
- Accounting of financial commitments and liabilities
- Adherence to generally accepted accounting principals (GAAP)
- Monthly closing and reporting.

Statutory and Regulatory requirements and fulfillment
- Tax Payments and submission of related returns.
- Statutory and regulatory fees/ contributions payment.
- Intimation and submission of forms/ returns with statutory and regulatory authorities

Revenue and cost assurance
To ensure correct billing to clients as per contract.
To ensure all cost obligations are accounted

Fund Management
- Ensure collection from clients
- Ensure funds are invested in most profitable manner
- Ensure cash flow management, vendor payment

KCPL’s Risk Management Framework Process standardization and document the processes Risk assessment of critical processes, Risk register and Controls Audit assurance on controls

KCPL’s Operational Risk Management Document the processes
- Document the process flows.
Prepare the list of processes with the process owners
Document the process flows as they are

Identify the risks associated with the processes.
- Train the process owners on risk identification.
- List the points of failure or possible opportunities for defects
- Document the inherent risks.

Prepare a risk register with the process owners

Document the controls for mitigating the risks.
- Standardize the processes
- Identify the controls and implement the same for Accept/ Reduce/ Transfer.
- Prepare an audit assurance plan to monitor the controls.
- Identify the action plans for implementing the same.
- Update the Risk register periodically.

Mitigation controls – Macro risks Area of Deployment Operations Lack of BCP/ DR
Information leakage Frauds
Lack of standard operating
procedures Mitigation Controls Concurrent Audit of CTs > Rs2 Lakh
Maker <> Checker Surveillance E-learning modules (SOPs) Approval for high value payouts Access rights ISO 27001 controls DR/BCP Area of improvement E-learning modules Corp registry

Mitigation controls – Macro Risks Epidemics
Industrial accidents Referral checks
Access controls ISO 27001 controls Mitigation Controls Structured performance management system Employee engagement - Rewards Health watch Facilities far off from Industrial estates Area of improvement Background check of Employees including temps

Mitigation Controls – Macro Risks Area of Deployment Administration Fire hazard
Attack by anti social elements Grid collapse
Wide spread social unrest Mitigation Controls Fire fighting equipment
Fire drills
Fire Insurance ISO 27001 controls DG sets with sufficient capacity Liaison with police Ability to lodge key resources in the facility 24x7 watch and ward

Mitigation Controls - Macro Risks Area of Deployment Information Security Networks Loss/ Theft of data
Denial of service attacks Infrastructure failure
Software failure/damage Data network link failures
Device and software failures Denial of Service attacks
Sabotage Mitigation Controls ISO 27001 controls
Change Management Enterprise class infra Access controls Redundant data lines from different service providers 24X7, monitoring of NW traffic by NOC Restricted super admin rights Vulnerability assessments Area of improvement Change Management Operational Level Agreement – IT & Ops

Mitigation controls – Macro risks- Business environment Area of Deployment Business risks Reduction of AUM
Client negotiations
Reputation risks
Collapse of economy Consolidation and consequent
attrition (Low Order Booking)
Investment risks
Regulatory risks Mitigation Controls Diversification into other business activities
Diversification into other emerging economies e.g. ME, East Asia To agree with minimum fee capping
Restrict to limited period and continuously engage with clients for restoration Internal controls, Check list approach and compliance adherence process Proactive client and media communication
Strong media relationship Pre investment due diligence of investment entity

KCPL’s Risk Management Framework Audit assurance on Controls

Internal Audit carried out in accordance with Auditing and Assurance Standards and Standards on Internal Audit issued by the Institute of Chartered Accountants of India

Risk based approach in addition to Transaction Audit

Understand the way the management operates and controls the business

Identify gaps in controls

Suggestions on additional control measures Scoping Audit Approach & Methodology

Prevention:
To identify risk in process flow
To mitigate internal and external fraud risk
To place controls in the system to filter deviations

Detection:
To detect process lapses at operational level
Rule based transaction level, system detection Investigation
To investigate on cases with deviations
To establish legitimacy of transactions detected

Deterrence
To apply back rules to the system based on investigations
To analyze data and place controls on potential risk areas Surveillance SCOPE

Detection methods adopted :

Control Environment:
Study of existing control policies to reinforce the procedures

Risk Assessment
Data Mining
Identification of Internal and External threat to control structure
Evaluation and Analysis

Control Activities
Procedural recommendations
Periodic procedural assessments

Monitoring
Daily transaction monitoring
Compliance of existing controls Transaction review methodology :

System based logics imbibed to detect transactions
Rule based system tracking
Manual transaction verification on queued up cases
Periodic review and analysis to identify trends

Reporting:

MIS on volume of transactions queued up and verified during the month
Daily reporting to the processing units on caution marked transactions
Monthly review on action taken on previous reports Surveillance-Detection & Review Methodology

Risk Parameters – Surveillance Module To be discussed

Internal audit being conducted on a concurrent basis by In- house Internal Audit team and External Chartered Accountant Firm

A Risk Assessment report prepared based on audit observations as part of monthly audit report

Review of existing internal control systems and processes to mitigate the risks

Review of Compliance requirements and Actual compliance

Review of Adherence to Generally Accepted Accounting Principles Audit Process

All divisions are continuously audited based on key parameters, viz. in case of Transfers, key parameters are signature of transferor, stamp duty paid, validity of transfer deed, capturing of investor name and address etc., likewise for other areas
Key parameters are decided based on risk assessment
Others factors viz. Control environment, Regulatory requirements, Contractual Obligations etc. define Audit scope as given hereunder: Audit Universe/scope

MFS – Commercial Transaction verification Audit Plan, Frequency and Extent of verification

MFS – Non-Commercial Transaction verification Audit Plan, Frequency and Extent of verification

MFS – Batch processes, Reports, MIS etc. Audit Plan, Frequency and Extent of verification

Audit Plan, Frequency and Extent of verification Corporate Registry

SURVEILLANCE DATA COLLECTION METHODS 100% verification of transactions falling under the following parameters Online application notifying the surveillance team with the transactions in the form of triggers in a PRE & POST-DATA processing scenarios. The module/application applies 15 basic parameters for instant data skimming and highlighting the ones requiring further scrutiny Surveillance Audit Plan, Frequency and Extent of verification

In addition to audit of Operations, audit of Books of Account, Contractual obligations viz. Payroll and Bills and adherence to Statutory & Regulatory Compliances are also verified. Further, on requirement basis, review of various processes are also taken up to identify gaps, if any and to take remedial actions Audit Plan, Frequency and Extent of verification

A Monthly report is shared with the clients, giving the :
Volume of transactions verified during the month
Deviations / errors noticed during the month

Comparative analysis on the month-on-month transactions verified and the deviations noticed

Various other aspects including TAT Compliance for regulatory and statutory reports, Tax deductions, Remittances etc. MFS - MIS reports to clients Audit Notification, Reporting and Follow ups

Audit Notification

Notification for audits are done by sending emails to the concerned staff of the divisions subsequent to personal/ telecon interactions with them. Though no specified templates are used for notification, the background, objectives, scope and information requirements are stated in the email

Audit Reporting on Initial Audit Observation

Initial audit observations are sent to the auditee through emails for discussion and feedback

Audit Follow ups

Audit Follow ups for information or for reply/feedback to Initial Audit Observations are done by personal interaction/telecon/through emails

Final Audit Report

Final Audit Report after incorporation of Management Comments are shared with the Concerned Staff Audit Notification, Reporting and Follow ups

Audit & Risk Presentation Overview of Risk

Related Topics

Share

Embed code

Download this presentation From Below

Presentation Transcript