Internal audit teams are playing a greater role in regulatory stress testing. Richard Barfield explains how they can add the most value.
For a mature stress-testing process (see Figure 1 for an overview) there is limited value for IA in ‘tick-box auditing’ – checking that process has been followed and that controls are operating. This should be a first line responsibility – those running the stress test. However the need for senior management to attest that robust processes and controls are in place often means that they will ask for assurance from IA. The review and challenge of assumptions and results is an integral part of any good stress-testing process.