Risk-based internal auditing and operational control in financial institutions: a systematic review

Abstract

Financial institutions face operational risks arising from human failure, inadequate processes, fraud, technological disruptions, and external events, which has encouraged a transition from traditional compliance-centered audits toward risk-based approaches. This review aimed to analyze whether risk-based internal auditing, compared with traditional auditing, improves operational risk identification and internal control effectiveness in financial institutions. A systematic review of publications issued between 2021 and 2026 was conducted in SCOPUS, Web of Science, SciELO, and Google Scholar, thirty open-access articles were included and distributed across the introduction, results, and discussion sections, while the evidence was synthesized through a narrative matrix covering study design, context, audit approach, findings, conclusions, and limitations. The evidence indicated that risk-based auditing supported the prioritization of critical areas, differentiated allocation of audit resources, timely monitoring, and integration among internal audit, risk management, and internal control, although its effectiveness depended on auditor independence, senior management support, risk culture, professional competence, data quality, and technological infrastructure, it should be emphasized that most studies employed cross-sectional designs and self-reported measures, therefore causal superiority over traditional auditing was not conclusively demonstrated. In summary, risk-based internal auditing showed a consistent improvement in operational risk identification and internal control effectiveness when audit findings were translated into implemented controls, continuous monitoring, and verifiable corrective actions.