Crisis and Risk Management for SAI Performance – or CRISP – support SAIs to develop and strengthen their risk, crisis and business continuity management systems, thereby helping them to perform under varying circumstances.

CRISP is an IDI initiative that came as a direct response to the needs of SAIs brought up by the COVID-19 pandemic. CRISP has a two-fold approach to supporting SAIs: offering courses and materials to all the INTOSAI community, and focusing on a more limited number of SAIs for direct support in developing their risk, crisis, and business continuity management systems. 

Rationale and objectives

Since March 2021, the COVID-19 pandemic has shown that many SAIs were not adequately prepared for large-scale disruptions and crises. Some had no business continuity plans in place; others had plans that were not functional and little tested. This made disruptions to their work more pronounced than they had to be and potentially undermined their role in the ensuring accountability in crises. Implementable and relevant crisis management plans will enable SAIs to face future disruptions more successfully.

The INTOSAI Development Initiative Global SAI Stocktaking Report 2020 shows evidence of this: ‘Globally, 53% of SAIs have an emergency preparedness and continuity plan. Lower income countries are significantly lagging behind the higher income countries.’ Indeed, while SAIs routinely evaluate changing and emerging risks in the audit environment^[1], it appears that a substantial proportion of them do not do this for their own strategy and operations.

^[1] See INTOSAI-P 12, The Value and Benefits of Supreme Audit Institutions – making a difference to the lives of citizens, Principle 5.

These challenges to SAIs have led IDI to develop and roll-out a new initiative, focusing on establishing and improving risk, crisis and business continuity management processes that help SAIs face future disruptions and strengthen their position in the accountability system of their respective countries.  

Implementation approach

While risk, business continuity and crisis management are closely interlinked aspects of organizational management, they are distinct processes designed to address distinct challenges. SAIs may thus, in many cases, participate in interventions on all topics, but some may also choose to focus on one or two of the three.

The first outputs for the initiative were the sensitization webinars on the topic, offered in English and French in September 2021, which also served as a chance for the community to provide input to the methodology.

By late 2022, IDI did roll-out its first course on risk management to 17 SAIs from the AFROSAI-E region followed by regular contacts to ensure that risk management activities are developed and implemented by the concerned SAIs. Thanks to this intervention, many SAIs have now adopted a risk management policy and are implementing a risk register.

A Quick Reference Guide on Risk Management for Supreme Audit Institutions has been developed and is currently available below in English, along with supporting templates for risk management, risk management policy and risk management reports. French, Arabic and Spanish versions will follow.

A course on crisis management is being developed and will be offered from 2024 in different languages while the roll-out of the risk management component will expand.

Business continuity management is on the agenda and work on this component will start in 2024.

Based on demand, SAIs will also be supported in developing and implementing risk, business continuity and crisis management procedures.

View and download the CRISP information brochure in your chosen language below, and for more information please contact us at crisp@idi.no