Existence of a quantitative measurement system. The internal auditors will verify that the entity has a system of quantitative measurement for OR based on risk indicators. This system should complement the results of the qualitative evaluations and must be integrated into the OR management process of the entity. So, internal auditors will have to verify the existence of appropriate tools for the definition, calculation and monitoring of the designated indicators.
. Predictive power of the system. From the point of view of internal audit, it will be necessary to evaluate the quality of the data used as input in the processes, the degree of automation, their origin, the frequency of the event measured, the weight assigned, etc. for the main indicators.
Also, the internal auditor will assess the suitability of the depth of the historic data loss series available for statistical evaluation, for the establishment of trends and to ensure the predictive capability of the risk indicators.
. Monitoring of the indicators. The internal auditors will check that the OR function regularly review, monitor and analyze the indicators used in the entity for the measurement of OR.
. Reporting of results to the areas and the senior management. There should be regular reporting of pertinent information to the business areas and senior management that supports the proactive management of OR. This way, internal auditors will review the timeliness, accuracy and relevance of this reporting, to ensure an effective OR management.