Since many of those risks will be at least partially offset by insurance, the database also should show the upper limits and deductibles that apply to each risk. The net uninsured risk drives the Monte Carlo simulation of future potential impacts, which should in turn direct management's mitigations, internal audit's assurance work, and periodic re-evaluation of insurance.
Monte Carlo does this by generating thousands of random scenarios in which the risks may or may not occur based on the experts' probability and impact estimates.
Sophisticated software is not needed. Monte Carlo can be done in Microsoft Excel and Google Sheets spreadsheets using the built-in random-number generation function RAND(). Each simulation will have at least two random components: 1) a random trigger as to whether the risk occurs or not based on its likelihood; and 2) a random cost within its estimated upper and lower range.
Running these calculations across all risks 10,000 times will create 10,000 versions of the future. This can then be aggregated into a probability distribution to provide a graphic picture of what the future might look like.
Monte Carlo creates several opportunities for internal audit:
- If Monte Carlo is not being used at your organization, the chief audit executive (CAE) may be able to take the lead in developing the simulation model to help direct internal audit's future priorities.
- Alternatively, if Monte Carlo is already used at your organization, the CAE can request access for the purpose of checking its completeness and aligning internal audit's work program to the highest risks.
- After linking internal audit's program to the Monte Carlo simulated model of the future, the underlying database of risks can be extended to include other assurance activities such as safety.
- And as a useful further step, the underlying database of risks can be linked to the various insurances in place for each risk.
In this way the risk database and Monte Carlo simulation model puts the CAE at the center of an expert-based predictive tool not only for demonstrating the relevance of internal audit's risk-based program, but also to bring focus to audit committee discussions about risk, assurance, and insurance. Even if audit committee members disagree with the expert estimates, those can be updated and recalculated in mere seconds.
For a fuller explanation about how internal auditors can use Monte Carlo, read "Prioritizing Risk for the Future."
Christopher Kelly, DProf, FCA, PFIIA, is a partner at internal audit consulting firm Kelly & Yang in Melbourne, Australia.