Approaching Internal Audits from an Enterprise Risk Management Perspective

Abstract

What do professional tennis and conducting an internal audit utilizing enterprise risk management (ERM) have in common? As Ed Caesar articulated in his Town & Country article, “Love All,” “there’s an infinitesimal margin between success and failure.” If you think about it, in professional tennis, top players study their opponent, plan their strategy, and execute their shots. Likewise, an internal audit will incorporate all aspects of an organization’s departments, operations, and risk. The goal in the assessment is to find the points of vulnerability or inherent risk. Not all risk is bad, however. For example, drop shots are risky when an opponent is at the back of the baseline, hits the return shot then positions him/herself in the middle to thwart either a close or a long shot. Likewise, evaluating a revenue cycle, for example, can uncover areas of vulnerability, which can then be mitigated through vehicles like insurance policies, leaving only a residual risk, akin to having the vantage of being at the middle of the court. The purpose of this article is to appreciate how to utilize facets of ERM to conduct an internal audit, appreciate what departments need to be analyzed, and provide strategic questions for auditors to implement.

Notes

i. American Health Lawyers Association, Enterprise Risk Management Handbook for Healthcare Entities, Second Edition, 15.

ii. Ed Caesar, “Love All,” Town & Country (October 2014). http://www.townandcountrymag.com/leisure/sporting/roger-federer-tc-oct-14#slide-1 (accessed October 4, 2014).

iii. Society of Actuaries, Enterprise Risk Management (ERM) Fact Sheet. https://www.soa.org/files/…/news-erm-fact-sheet.pdf (accessed November 24, 2014).

iv. Supra n. 1, 12.

v. The Economist (sponsored by KPMG and ACE), Fall Guys Risk Management In the Frontline (2010). http://www.kpmg.com/US/en/IssuesAndInsights/ArticlesPublications/Documents/iarcs-erm.pdf (accessed November 24, 2014).

vi. Stephen Sims, Qualitative v. Quantitative Risk Assessments. http://www.sans.edu/research/leadership-laboratory/article/risk-assessment (accessed November 24, 2014).

vii. Supra n. 1, 7–11.

viii. M. Frigo and R. Anderson, COSO, Thought Leadership in ERM—Embracing Enterprise Risk Management, Practical Approaches for Getting Started (2011). http://www.coso.org/documents/EmbracingERM-GettingStartedforWebPostingDec110_000.pdf (accessed November 24, 2014).

Additional information

Notes on contributors

Rachel V. Rose

Rachel V. Rose, JD, MBA is a Houston-based attorney and affiliated faculty at the Baylor College of Medicine Center for Bioethics. She advises on federal and state compliance and areas of liability associated with a variety of healthcare and securities legal and regulatory issues, including HIPAA and Dodd-Frank. She holds an MBA from Vanderbilt University and a JD from Stetson University College of Law. She can be reached at [email protected]. The author would like to thank Jackson Nicholson of The Golf Channel for his time and insights.