Abstract: A system provides audit opinions on an enterprise's organizations, processes, risks, and risk controls. The system first evaluates the enterprise's set of risk controls. The audit opinions of the set of risk controls are used to evaluate the set of risks associated with the set of risk controls. The audit opinions of the set of risks and of the set of risk controls are in turn used to evaluate the set of processes associated with the set of risks. Finally, all of these audit opinions are used to evaluate the set of organizations associated with the set of processes. The system streamlines the evaluation of risk by determining suggested audit opinions. Suggested audit opinions for a given item can be determined from audit opinions previously determined and associated with the given item. Rules can be defined for a given item to specify how to determine the suggested audit result.

Abstract: A system provides audit opinions on an enterprise's organizations, processes, risks, and risk controls. The system first evaluates the enterprise's set of risk controls. The audit opinions of the set of risk controls are used to evaluate the set of risks associated with the set of risk controls. The audit opinions of the set of risks and of the set of risk controls are in turn used to evaluate the set of processes associated with the set of risks. Finally, all of these audit opinions are used to evaluate the set of organizations associated with the set of processes. The system streamlines the evaluation of risk by determining suggested audit opinions. Suggested audit opinions for a given item can be determined from audit opinions previously determined and associated with the given item. Rules can be defined for a given item to specify how to determine the suggested audit result.

Abstract: An audit system includes a library of controls adapted to mitigate risks. A library of audit procedures is associated with the set of risk controls. Each audit procedure includes one or more actions that evaluate the effectiveness of an associated control. The audit system includes project templates for performing audit procedures associated with risk controls in a project management application. An audit project template can include standard audit procedures, document templates, and standard deliverables needed for an audit of an associated control. The project management application enables collaboration between auditors by providing planning functions, task assignment functions, progress tracking functions, communication functions, and document management functions. The library of audit procedures is included in a hosted audit service.

Abstract: An audit system creates, deploys, and analyzes surveys to perform risk assessment. Surveys can be associated with one or more contexts, which include an enterprise, an organization, a business process, a risk, a control, or any combination thereof. The audit system generates survey questionnaires for a context automatically using a question library that associates questions with one or more contexts. Using the process library and the associated sets of process risks and process controls, the audit system can automatically determine the set of individuals that should participate in the survey. The audit system can then distribute survey questionnaires to the set of individuals and collect the survey results. Survey results can be aggregated to create risk assessments detailing the perceived risks to the survey context. Additionally, survey results and risk assessments can be saved for future reference or to document an enterprise's good-faith efforts to comply with its legal obligations.

Abstract: An audit system includes a set of business processes that describe the operations of an enterprise. The audit system has a registry of incompatible business functions created from a library of business processes. Each pair of incompatible business functions is associated with one or more risks. Each risk can include a category, a risk probability, and/or a risk impact. An audit manager compares the business function incompatibilities of the registry with the set of business functions assigned to the employee, and a report generator creates a report identifying the risk introduced by the match. The audit manager creates an audit task in response to a match. An impacted financial statement manager displays a financial statement, a set of financial accounts, a set of business functions and the set of risks associated with the set of financial accounts.