Internal Audit Risk Measures Measure Level Description Insignificant ...
Internal Audit Risk Measures Measure IMPACT Aggregate dollar effect and qualitative factors over a three year planning horizon.
Level Insignificant
Description Little to no effect on financial performance or mission, reputation or interest.
Minor
Minimal effect on financial performance of $1M to $5M and / or may slightly affect mission, reputation or interest. - Moderate impact on financial performance of $5M - $50M - May noticeably impact, violate, harm or impede mission, reputation or interest. - Noticeable impact on financial performance of $50M - $100M - May significantly violate , harm or impede mission, reputation or interest. - May require Board involvement and disclosure protocols are triggered. - Significant impact on financial performance of $100m or greater - Will significantly violate , harm or impede mission, reputation or interest. - Requires Board involvement and disclosure protocols are triggered.
Moderate
Major
Critical
LIKELIHOOD Rare The likelihood that a risk will materialize over a three-year Unlikely period Possible
Almost Certain
Exceptional circumstances or less than a 10% probability that the risk will occur over a three-year period Between 10% - 30% probability that the risk will occur over a three year period. Between a 30% - 50% probability that the risk will occur over a three year period Between a 50% - 85% probability that the risk will occur over a three year period Greater than 85% probability that the risk will occur over a three year period
Gradual Rapid Immediate
Risk velocity is gradual > 1 to 3 years Risk velocity is moderately paced (occurs within one year) Risk velocity is immediate and without warning
Likely
VELOCITY The rate at which a risk materializes
Level Insignificant
Description Little to no effect on financial performance or mission, reputation or interest.
Minor
Minimal effect on financial performance of $1M to $5M and / or may slightly affect mission, reputation or interest. - Moderate impact on financial performance of $5M - $50M - May noticeably impact, violate, harm or impede mission, reputation or interest. - Noticeable impact on financial performance of $50M - $100M - May significantly violate , harm or impede mission, reputation or interest. - May require Board involvement and disclosure protocols are triggered. - Significant impact on financial performance of $100m or greater - Will significantly violate , harm or impede mission, reputation or interest. - Requires Board involvement and disclosure protocols are triggered.
Moderate
Major
Critical
LIKELIHOOD Rare The likelihood that a risk will materialize over a three-year Unlikely period Possible
Almost Certain
Exceptional circumstances or less than a 10% probability that the risk will occur over a three-year period Between 10% - 30% probability that the risk will occur over a three year period. Between a 30% - 50% probability that the risk will occur over a three year period Between a 50% - 85% probability that the risk will occur over a three year period Greater than 85% probability that the risk will occur over a three year period
Gradual Rapid Immediate
Risk velocity is gradual > 1 to 3 years Risk velocity is moderately paced (occurs within one year) Risk velocity is immediate and without warning
Likely
VELOCITY The rate at which a risk materializes
