Should internal audit assign dollar values to every risk it reports?

author: AcadiFi Team

Answer:

No. Internal audit should quantify exposure when the audit evidence supports it and when quantification helps the conclusion. For example, duplicate payments, missed discounts, or known exception dollars may be calculated from the tested population.

But many risks are not cleanly reduced to one dollar value by internal audit. Cyber, safety, regulatory, reputation, and strategic risks may need scenario analysis, qualitative severity, or ERM methodology. Risk management and business owners usually own enterprise risk valuation and response.

Internal audit's responsibility is to present supported evidence, risk implications, and conclusions. It should not invent dollar values just to satisfy a risk-register field.