-
Value at Risk (VaR) Explained: Definition, the Three Methods, Backtesting and Limits
Value at Risk is a single number that answers a precise question: over a given horizon, at a given confidence level, what is the most this portfolio should…
Updated
·
18–27 minutes -
Market Risk: Types, Measurement, Capital Rules in 2026 and How Internal Audit Tests It
The Risk Library reference on market risk: what it is and why the OCC calls it price risk; the five risk types and their sources; sensitivities, VaR, expected…
Updated
·
22–33 minutes -
Operational Risk Guide for Internal Auditors (2026)
Operational risk from the third line’s seat: the Basel event types with examples, the framework’s components with the audit test for each, twelve leading KRIs with thresholds, loss…
Updated
·
21–31 minutes -
Credit Risk: Ratings, PD/LGD/EAD, CECL, Capital and How Internal Audit Tests It
The Risk Library reference on credit risk: the six forms of the risk, the lifecycle from underwriting to workout and the control at each stage, risk ratings and…
Updated
·
22–33 minutes -
IRR vs IRRBB vs SIRR: Interest Rate Risk in the Banking Book, Explained
Interest rate risk (IRR) is the risk; interest rate risk in the banking book (IRRBB) is the supervisory category the Basel Committee defined for the non-trading book; structural…
Updated
·
26–38 minutes -
Interest Rate Risk: Measurement, Limits, Regulation and How Internal Audit Tests It
The Risk Library reference on interest rate risk: repricing, yield curve, basis and optionality risk; economic value of equity and net interest income; the deposit and prepayment assumptions…
Updated
·
31–46 minutes -
Fraud Risk Management: The Complete Guide to Assessment, Controls and Audit’s Role
Fraud risk management for internal auditors and the managers who run programmes: how fraud is classified, why it happens, the COSO and ACFE five-principle framework, a scheme-level fraud…
Updated
·
22–32 minutes -
How to Audit Business Continuity and Resilience (2026 Guide)
Auditing resilience as a capability, not a binder: the 2026 setting (the IIA Topical Requirement effective 30 April 2027, DORA, the UK regime, ISO 22301), precise vocabulary, all…
Updated
·
22–34 minutes -
Strategic Risk: Definition, Sources, Assessment, Governance and the Audit Tests
The Risk Library reference on strategic risk: three framings (OCC, COSO, business model analysis), the boundaries with operational, reputation and financial risk, nine sources with the cases that…
Updated
·
22–33 minutes -
Blockchain and Crypto-Assets for Internal Auditors: Risks, 2026 Rules, Controls, Tests
Blockchain and crypto-assets as an audit subject: what the technology guarantees and what it does not, the ten exposures, the regulatory position in October 2026 (GENIUS Act, the…
Updated
·
18–27 minutes -
Model Risk Audit: How Internal Audit Validates the Models Management Relies On
How internal audit audits model risk management rather than re-validating models: SR 11-7 and the April 2026 revised guidance, a tiering table, a 20-test work program, a validation-report…
Updated
·
32–48 minutes -
Internal Audit in Financial Services: AML, Compliance, MRAs
What is different about the third line in a regulated institution: the audit universe by risk stripe, a regulator-expectation matrix (OCC, Fed, FDIC, FINRA, NAIC, NCUA), a 16-component…
Updated
·
20–30 minutes -
Fraud Risk Management and Internal Audit: Prevention, Detection, and Response
A working guide to internal audit’s role in fraud risk management: a 26-scheme catalog with the detective analytic for each, a scored fraud risk assessment, an investigation protocol,…
Updated
·
37–55 minutes -
ESG Auditing: Frameworks, the 2026 Disclosure Rules, Data Controls and a Test Program
The internal audit guide to ESG: four engagement types, the disclosure rulebook as of October 2026 (Omnibus-amended CSRD, ISSB adoption, the SEC’s proposed rescission, California’s November 2026 deadline),…
Updated
·
27–41 minutes -
Risk-Based Internal Auditing: How Risk Drives the Plan, the Scope and the Testing
Risk-based auditing is the discipline of letting assessed risk, rather than the calendar or the org chart, decide what internal audit looks at, how deeply and how often.…
Updated
·
18–27 minutes -
Risk Control Matrix (RCM): Names, Variants and Approaches
Within the realm of risk management and internal audit, practitioners encounter various names and approaches for what is essentially a risk control matrix (RCM). These variations, while similar…
Updated
·
3–4 minutes -
OCC Risk Categories: The 8 Risk Stripes Explained
For decades the OCC supervised US national banks through eight risk categories, often called risk stripes: credit, interest rate, liquidity, price, operational, compliance, strategic, and reputation. Since 2025…
-
Enterprise Risk Management History: A Timeline
Enterprise risk management (ERM) stands today as a cornerstone of organizational resilience, guiding companies through turbulent markets, regulatory shifts, and ever-changing global landscapes. Yet the roots of risk…
Updated
·
18–27 minutes -
Hospital Revenue Cycle Audit: Controls From Registration to Collections, With 14 Tests
The hospital revenue cycle for auditors: the cycle stage by stage with owners and failure symptoms, front-end, middle and back-end risks and controls with tests, the metrics and…
Updated
·
18–27 minutes -
Fooled by Randomness by Nassim Taleb: Summary and Lessons for Auditors
Taleb’s first book for general readers, summarised for auditors: the characters, nine ideas, a vocabulary, what it means for track records, incident data and controls that have not…
Updated
·
18–28 minutes -
Against the Gods by Peter Bernstein: The History of Risk, Summarised for Auditors
Bernstein’s history of risk, summarised for auditors: the five eras, the story in twelve steps, nine ideas, a vocabulary, the assumptions inside the profession’s tools, and a worked…
Updated
·
18–27 minutes -
Risk: A User’s Guide by McChrystal and Butrico: Summary for Auditors
McChrystal and Butrico’s framework for the risk immune system, summarised for auditors: the argument, the ten factors, the cases, a vocabulary, an audit map for response capability and…
Updated
·
18–27 minutes -
Internal Audit’s Role in ERM: Assurance, Advice, and Limits
The roles table with a safeguard for every advisory role, charter and engagement-letter language, a five-level ERM maturity rubric across six dimensions, a 15-row ERM audit program, an…
Updated
·
22–33 minutes -
Bank Regulatory Thresholds in 2026: The US Ladder, Tailoring Categories, EU, UK and Japan
A reference to bank regulatory thresholds as they stand in October 2026: how thresholds are measured and indexed, the United States ladder from one billion dollars to the…
Updated
·
19–28 minutes -
Risk Management Frameworks Compared: COSO, ISO 31000, NIST
Nine frameworks and models in one comparison with what each is for and is not, a decision table for which fits which situation, the eight elements every framework…
Updated
·
20–29 minutes -
Auditing Credit Risk: Scope, Tests, and Red Flags
Auditing credit risk comes down to four tests: independently re-grading a judgmental sample of loans, testing underwriting and policy exceptions, validating watchlist and rating-migration governance, and assessing the…
Updated
·
19–28 minutes -
Key Risk Indicator Examples: KRI Tables by Risk Type, With Thresholds and Owners
A reference library of key risk indicator examples: thirteen tables covering credit, liquidity, interest rate, market, operational, technology and cyber, fraud and financial crime, compliance and conduct, people…
Updated
·
23–34 minutes -
Reputation Risk: Definition, Drivers, Measurement, the 2026 Supervisory Change, the Audit
The Risk Library reference on reputation risk: the Basel definition, why it is a risk of risks, where reputation events come from with ten cases, the 2023 lesson…
Updated
·
19–29 minutes