The board formally approves the authority, role and responsibilities that empower Northstar’s internal audit function to access records, personnel and physical property when performing its work.

After identifying the risk of a critical medical-supply interruption, management estimates the probability of the disruption and evaluates the potential financial and operational consequences.

Divisional managers systematically identify and document events that could prevent Northstar from achieving its strategic and operational objectives.

Management maintains a central document containing identified risks, risk owners, categories, likelihood ratings, consequences, existing controls and risk interdependencies.

Northstar combines the risk-management activities of its healthcare, logistics, retail, energy and technology divisions into a coordinated organisation-wide process aligned with its strategic objectives.

The approved authority, organisational position, reporting relationships, scope, access rights and types of internal audit services are recorded in one formal document.

The CAE prioritises proposed internal audit engagements according to the significance of identified risks and their possible effect on Northstar’s objectives.