‘‘Risk’’ is defined as the possibility that an event will occur and adversely affect achievement of the organization’s strategic objectives over time. Today’s economy requires companies to identify and respond more quickly to changing risk profiles. To achieve this, risks must first be prioritized based on significance.

This guide can be used by auditors to facilitate a risk assessment workshop. This guidance document is organized to take auditors through the high-level phases of a risk assessment discussion and provide insight into the facilitator’s role for this process.