TIAPS Module 1 Audit and Assurance workbook

Risk Management
Similar comments as those made in respect of compliance (see above) apply to risk
management more generally. It relies on the actions of multiple parties (most notably the
CEO, CFO, and a Chief Risk Officer or equivalent) together with the support of internal audit.
There may not be an individual or team with organizational responsibility for risk
management and so the task is shared among managers, blending first and second line
roles.
Information and Decision Support
The APEC guidance describes essential requirements for information and decision support:
• Standards for the creation and retention of public records, usually established by
legislation.
• Procedures within organizations to ensure the standards are met.
• Quality data, information, and analysis to inform decisions taken by government
boards and committees.
• The keeping of records of decisions established by government boards and
committees, including the points considered or discussed in reaching those
decisions. 17
Review and Evaluation
In the final element, the APEC guidance recognizes the importance of continuous
improvement to governance supported by review and evaluation.
• Ideally, governance arrangements should be reviewed in detail every year or two,
particularly when there is a significant event affecting or potentially affecting those
arrangements, such as a major legislative change or recommendations from a
government committee or an external auditor.
• An internal review led by the Minister or board of directors and/or executive
management would normally suffice. Occasionally, where an organization could
benefit from outside objectivity and expertise, a formal, externally facilitated review
should be conducted.
• The scope of the review may extend across the full range of the organization’s
activities or else be confined to a performance assessment of the Minister or board of
directors and/or executive management. In either instance, the fulfilment of both
performance and conformance objectives should be evaluated.
• Smaller and/or less complex organizations need not review their governance
arrangements as frequently or in as much depth as larger and more complex
organizations.
• Organizations with significant policy or operational risk need to review their
governance practices more frequently and more thoroughly.
• Results from the reviews of governance arrangement should be acted upon in a
reasonable timeframe 18
17
APEC Economic Committee’s Good Practice Guide on Public Sector Governance, 2011.
18
APEC Economic Committee’s Good Practice Guide on Public Sector Governance, 2011.
24