Internal Audit Departments and Building a Definition of Risk

Internal Audit Departments today are constantly told to be "risk based" and to assist their companies in the management of risk. While this sounds great in concept, the execution is a different manner as many companies today do not have a formal risk management program with which to align. When tasked with developing such programs Internal Audit should not fall into the trap of developing a population of risks before first arriving at a common definition of risk.

Understanding how your company views risk is a good place to start. Is risk viewed as good or bad? Remember, risk is not just a negative; the presence of risk presents the possibility of reward as well as loss. In looking at risk as both a positive and negative, Internal Audit Departments will better align their risk activities with the thoughts and strategies of management.

This definition, once developed, can then allow Internal Audit Departments to evaluate risks and risk management activities to determine if the potential for success warrants the risk being taken; to assess whether the risks being taken are aligned with corporate values, goals, objectives, policies and management capabilities; and to determine whether the culture of your organization is strong enough to allow for a legitimate discussion about risk events that haven’t yet happened.

---

This post was contributed by Brad Zolkoske. Brad is the Director of Internal Audit at International Coal Group. He is responsible for the design, development, coordination and communication of auditing services throughout the company. Brad’s number one goal at International Coal is to establish a professional internal audit function that actively supports the company’s growth and culture initiatives.

During the course of his 20 year internal audit career Brad has worked in internal audit management for several publicly traded manufacturing companies. He is an expert at getting exceptional performance out of small audit departments. Brad can be contacted through this blog or through his LinkedIn profile.

Construction Auditing: the Foundation to Risk Management and Internal Control

As the global economy slowly recovers, companies will begin to invest once again in large construction projects. Many projects that had been on hold through the downturn are now beginning to find funding. These projects include both new construction and significantly upgrading facilities such as: Distribution Centers, Manufacturing Facilities, Shared Service Centers, Retail Sites, Data Warehouses, Educational Facilities, and Healthcare Facilities.

While a multimillion dollar project represents one of a company’s largest capital expenditures, it is sometime on of the least controlled expenditures. On October 21st, the Senior Supervisors Group issued a report on the financial crisis and in it they stated, “…weaknesses in risk management and internal controls contributed to industry distress during the financial crisis.” Similarly, weak risk management practices and internal controls could lead to significant losses or delays in a large construction project.

Companies need to learn the lessons of the financial crisis and embed risk management and internal control into all processes, especially construction. The first step to improving risk management and internal control is to leverage the principals of audit. An audit, in this case a construction audit, provides the foundation.

Construction Auditing starts with the Construction Contract
A construction contract will include a variety items such as project description, project timeline, cost estimate, payment terms, documentation requirements and sections on insurance and indemnification. However, the contract should also include certain provisions to specifically protect the owner’s interest. The American Institute of Architects provides a series of standard construction contracts which can be used as a template for construction projects. While these templates provide a solid framework, they are not necessarily written with a bias towards owners rights. Provisions such as “Right-to-Audit” and “Change Orders” plus other internal control enhancements need to be customized. These modifications will improve the owner’s control over project costs, allow for recoveries, and are necessary to strengthen the ability to audit.

"The audit is an integral part of the construction project process. Performed well by seasoned professionals it will assure the Owner that financially they received the product contracted and paid for."

Knowing what to modify and even how to modify is not common knowledge and can’t be done through the legal review process. It is critical to have this review completed by an experienced construction audit professional and it should be done prior to executing the contract. Doing so will save thousands, if not hundreds of thousands of dollars throughout the project.

Pro Bono Construction Contract Health Check
Are you confident in your construction contracts, but would like a second look? For a limited time, Vonya Global will provide a pro bono review of your construction contracts. Certain limitations apply, please call or email for additional information.