Audit, risk, compliance and ethics

Organisations operate in environments where risks are becoming more numerous, more interconnected and more difficult to anticipate. Regulatory pressures, cyber threats, fraud, corruption, control failures, third-party risks, breaches of confidentiality or reputational crises can now have rapid and lasting effects.

The key challenge lies in the ability to detect vulnerabilities before they turn into major failures. Having rules in place is not enough: they must also be understood, applied, monitored and integrated into governance decisions.

The audit, risk and compliance functions are also undergoing profound change. They are no longer expected merely to carry out retrospective checks; they must now contribute to prevention, anticipation and informed decision-making.

At the same time, ethics is playing an increasingly important role in governance. Senior managers are called upon to resolve situations where legality, performance, institutional interests, reputation and accountability may come into conflict. Mastering these issues is becoming as much a management skill as it is a control requirement.

In this context, several issues are becoming crucial:

• Integrated risk management: identifying, prioritising and monitoring risks that could affect objectives, resources or reputation.
• Effective internal control: securing critical processes and reducing vulnerabilities that could lead to losses, errors or disruptions.
• The evolving role of audit: making audit a tool for assessment, early warning and advice in support of governance.
• Compliance and regulatory risks: anticipating obligations, organising accountability and safeguarding the organisation’s practices.
• Prevention of fraud and corruption: identifying vulnerabilities, strengthening early-warning systems and establishing mechanisms for handling such issues.
• Ethical decision-making: enabling managers to make judicious judgements when competing interests or responsibilities arise.
• Governance of sensitive information: controlling access, circulation, confidentiality and traceability of critical information.
• Third-party risks: assessing partners, suppliers, intermediaries and other stakeholders who may expose the organisation to risk.
• Resilience and continuity: preparing the organisation to maintain its essential functions in the event of a crisis or major disruption.
• Trust and reputation: making integrity, transparency and accountability sustainable factors in institutional credibility.

The challenge, therefore, is not merely to prevent incidents, but to build an organisation capable of understanding its risks, assuming its responsibilities and sustaining trust over the long term.

The Area of Excellence ‘Audit, Risk, Compliance and Ethics’ covers the key mechanisms that enable organisations to assess, safeguard and ensure accountability in their operations.

• Governance of audit, risk and compliance: organisation of control functions and coordination of their responsibilities with senior management, boards and specialist committees.
• Strategic and performance audit: assessment of governance, efficiency, results and risks to inform high-level decision-making.
• Internal control and process security: designing and improving systems tailored to risks, objectives and critical activities.
• Enterprise Risk Management: developing a comprehensive view of risks and integrating risk management into governance decisions.
• Mapping and management of strategic risks: identifying, prioritising and monitoring risks likely to affect key objectives.
• Compliance and regulatory risks: structuring compliance frameworks and anticipating regulatory changes applicable to the organisation.
• Fraud and corruption prevention: identifying vulnerabilities, establishing early warning systems, conducting investigations and implementing institutional prevention mechanisms.
• Ethics, integrity and executive accountability: integrating ethical requirements into decision-making, leadership and the exercise of responsibilities.
• Information governance and confidentiality: organising access to, retention, circulation and protection of sensitive information.
• Conflicts of interest and governance risks: identifying and addressing situations that may compromise impartiality or integrity.
• Third-party risks and integrity due diligence: assessing partners, suppliers, intermediaries and other third parties that expose the organisation to specific risks.
• Business continuity and organisational resilience: preparing measures to maintain critical functions and restore operations following a disruption.

These areas of expertise enable risk management to be approached as a fully-fledged governance function, at the intersection of control, accountability and performance.

Programmes in this field develop the skills required to assess control mechanisms, anticipate risks and promote accountability in decision-making and practices.

• Setting up an audit or compliance function: defining roles, responsibilities, governance relationships and appropriate oversight mechanisms.
• Assessing an organisation’s performance: evaluating the economy, efficiency, effectiveness, results and risks of a system or activity.
• Design an internal control system: identify critical processes, vulnerabilities and the necessary controls.
• Develop a risk map: identify, analyse, prioritise and monitor risks likely to affect key objectives.
• Managing a compliance framework: organising the obligations, controls, responsibilities and monitoring mechanisms required to ensure regulatory compliance.
• Preventing and detecting fraud: identifying warning signs, vulnerabilities and appropriate preventative or investigative responses.
• Preventing the risks of corruption: putting in place mechanisms for prevention, early warning, control and the handling of sensitive situations.
• Resolving ethical dilemmas: analysing the responsibilities, interests and consequences of a decision where these may come into conflict.
• Managing conflicts of interest: identifying high-risk situations and applying mechanisms for prevention, disclosure or resolution.
• Protecting sensitive information: organising access, confidentiality, retention and traceability of critical information.
• Assessing third-party risks: implementing due diligence and control procedures tailored to partners and suppliers.
• Preparing for business continuity: identifying critical functions, anticipating disruptions and organising recovery mechanisms.

These skills enable participants to move from a reactive approach to a culture of prevention, vigilance and accountability in the management of organisations.

In this Area of Excellence, the IIRCF offers programmes focusing on audit, internal control, risk, compliance, integrity and organisational accountability.

• Executive Certificate in Governance, Audit and Risk Management: to provide senior managers with an integrated view of audit, control and risk as governance tools.
• Executive Certificate in Governance of Audit, Risk and Compliance Functions: to organise control functions effectively and manage their relationships with senior management and governance bodies.
• Executive Certificate in Governance and Performance of Audit Committees: to professionalise the oversight of financial reporting, audit, risk and compliance.
• Executive Certificate in Strategic Audit and Advice to Senior Management: to develop the auditor’s role towards strategic analysis and advising senior management.
• Executive Certificate in Organisational Performance Audit: to assess the economy, efficiency, effectiveness and results of an organisation or system.
• Executive Certificate in the Design and Management of Internal Control Systems: to build or transform a control framework tailored to risks and objectives.
• Executive Certificate in Enterprise Risk Management and Risk Governance: to develop a comprehensive view of risks and integrate them into major decision-making.
• Executive Certificate in Strategic Risk Mapping and Management: to identify, prioritise and monitor risks likely to affect key objectives.
• Executive Certificate in Compliance Governance and Compliance Management: designing and managing a comprehensive compliance framework.
• Executive Certificate in Ethics, Integrity and the Prevention of Governance Risks: prevent conflicts of interest, abuse of power and ethical failings.
• Executive Certificate in the Prevention and Detection of Organisational Fraud: identifying vulnerabilities and strengthening detection capabilities.
• Executive Certificate in Corruption Prevention and Integrity Governance: developing systems for the prevention, control, reporting and management of corruption risks.
• Executive Certificate in Whistleblowing Schemes, Internal Investigations and the Handling of Reports: organising the receipt, analysis and credible handling of internal reports.
• Executive Certificate in Decision-Making Ethics and Executive Accountability: to mediate complex situations where performance, legality and accountability may come into conflict.
• Executive Certificate in Information and Confidentiality Management: organising the access, use, retention and protection of sensitive information.
• Executive Certificate in Third-Party Risk Governance and Integrity Due Diligence: assessing risks associated with partners, suppliers, intermediaries and other third parties.
• Executive Certificate in Business Continuity and Organisational Resilience: prepare the organisation to maintain its critical functions and recover following a major disruption.

This programme enables participants to develop a comprehensive understanding of the control, prevention and accountability functions that underpin organisational trust and resilience.

The IIRCF supports organisations wishing to strengthen their audit, control, risk management, compliance and integrity frameworks.

• Assessment of control frameworks: analysis of audit, control, risk and compliance functions to identify gaps, overlaps and priorities for improvement.
• Strengthening audit and control functions: bespoke programmes for auditors, control officers and governance managers.
• Structuring risk mapping: developing the capacity to identify, prioritise and monitor the organisation’s major risks.
• Compliance and integrity programmes: strengthening the skills required to prevent regulatory, ethical and reputational risks.
• Fraud and corruption prevention: training for teams responsible for preventing, detecting, reporting and handling irregularities.
• Professionalisation of audit committees and supervisory bodies: developing capabilities for control, arbitration and oversight at the governance level.
• Ethics and professional conduct frameworks: support for capacity building amongst teams responsible for codes, advisory mechanisms, awareness-raising and monitoring.
• Governance of sensitive information: strengthening practices relating to confidentiality, traceability, access and accountability concerning critical information.
• Due diligence and third-party risks: developing capabilities to assess and manage risks associated with partners, suppliers and intermediaries.
• Business continuity and resilience: strengthening capabilities to prepare responses to disruptions and safeguard essential functions.
• A culture of control and accountability: programmes designed to promote common practices of integrity, vigilance and accountability throughout the organisation.

These solutions enable organisations to strengthen not only their control mechanisms, but also the culture of accountability that determines their actual effectiveness.