Auditing Risk Assessments: How Internal Audit Can Strengthen Online Safety Act Compliance
Online safety is no longer just a policy issue—it is now a board-level priority. As digital platforms evolve, so do the risks facing their users, especially children. The UK’s Online Safety Act (OSA)1 has raised the bar, placing clear legal duties on companies to identify, assess and address harmful and illegal content. Internal audit functions are uniquely positioned to help companies navigate compliance: not only to provide independent assurance over whether the framework is well designed, operating effectively, and capable of regulatory scrutiny but also to strengthen trust, protect reputation, and foster a safer online environment.
Why this matters now
The OSA calls for a proactive, structured approach to identifying, assessing, and mitigating online safety risks. Yet many organisations are still finding their footing. Ofcom’s Year 1 review of online safety risk assessments2 revealed that many organisations struggle with incomplete or inconsistent risk assessments, particularly when it comes to children’s safety. Key issues include lack of granularity in risk identification, insufficient consideration of children’s safety, weak justifications for low risk levels, and poor documentation. In short, compliance is not simply about having a risk assessment—it is about having one that stands up to scrutiny.
It is also worth noting that Ofcom highlights the importance of the outcomes of risk assurance processes, which can be used as an enhanced evidence input for the illegal content and children’s risk assessments3. This underscores the value of internal audit in strengthening the credibility and robustness of an organisation’s risk assessment process.
This is not a one-off exercise; it requires continuous vigilance and adaptation. Internal audit is perfectly positioned to:
- Provide independent assurance on the governance, risk management and control framework supporting OSA compliance.
- Assess whether compliance’s oversight, challenge and monitoring activities are appropriately designed and operating effectively.
- Identify assurance gaps, thematic weaknesses, and opportunities to strengthen resilience.
What a strategic internal audit approach looks like
Internal audit's engagement with OSA risk assessments should be comprehensive, moving beyond a simple checklist to a comprehensive assessment of the overall compliance framework. The goal is to understand whether the monitoring framework is robust, responsibilities are clear, and whether first- and second-line activities are effective. Here are some key areas where internal audit adds substantial value:
- Assessment of the robustness of the process used to identify in-scope services. This includes verifying that the identification process is sufficiently comprehensive, well-governed, and responsive to evolving regulatory requirements.
- Review of the effectiveness of governance arrangements, accountability frameworks, and the processes for reviewing and updating risk assessments.
- Verification that robust reporting and escalation channels are in place for online safety incidents and emerging risks.
- Assessment of whether the risk assessment methodology is suitably designed, consistently applied, and supported by adequate evidence and governance. This includes scrutinizing its alignment with regulatory requirements and relevant guidance (e.g., sections 9, 11, 26, 28 of the OSA1, Ofcom’s Risk Assessment Guidance and Risk Profiles3, Register of Risks4, Illegal Content Judgements Guidance5, Guidance on Content Harmful to Children6, and A Safer Life Online for Women and Girls Guidance7).
- Independent testing of whether key controls are effectively designed, operating as intended, and subject to meaningful monitoring and remediation, including consideration of their alignment with Ofcom’s Codes of Practice or justified alternatives8.
- Evaluation of the mechanisms in place for continuously monitoring the effectiveness of controls and their ability to adopt as new risks emerge, user behaviour changes, or technological landscapes evolve.
- Assessment of whether records provide a clear, defensible trail showing what risks were identified, which controls mitigate them, and how conclusions were reached. This is crucial for demonstrating compliance and accountability, considering alignment with regulatory requirements and relevant guidance (e.g., sections 23 and 34 of the OSA1, Ofcom’s Record-Keeping and Review Guidance9).
Conclusion
Looking ahead, Ofcom’s roadmap10 indicates that the regulatory framework under the Online Safety Act will continue to develop through a combination of further consultations, more detailed guidance, and increasingly active enforcement. For internal audit departments, this is an opportunity to add substantial value by providing independent assurance, identifying critical areas for improvement, and helping their organisations build resilient and responsible online platforms. By focusing on the robustness of the risk assessment process, the effectiveness of controls, and learning from regulatory insights, internal audit can play a pivotal role in navigating the complexities of the digital world and ensuring a safer experience for all users.
References
2. Online Safety Risk Assessments - Year one
3. Risk Assessment Guidance and Risk Profiles, Children’s Risk Assessment Guidance and Children’s Risk Profiles
4. Register of Risks, Children's Register of Risks
5. Illegal Content Judgements Guidance
6. Guidance on content harmful to children
7. Guidance A safer life online for women and girls
8. Illegal content Codes of Practice for user-to-user services, Illegal content Codes of Practice for search services, Issued Protection of Children Code of Practice for user-to-user services, Issued Protection of Children Code of Practice for search services
