When estimating the impact of an inherent risk, internal auditors should consider both financial and nonfinancial factors. Financial factors include direct monetary impacts, while nonfinancial factors may include reputational damage, operational disruptions, and compliance issues. Considering a broad range of factors provides a comprehensive understanding of the potential impact of the risk, which is essential for effective risk assessment and management.
Reference:
Institute of Internal Auditors (IIA) Standards: Performance Standards 2120: Risk Management COSO Enterprise Risk Management (ERM) Framework: Risk Assessment and Risk Response Components