Scribd Logo
Upload

Welcome to Scribd!

  • 73 views

    Chapter 6 - Risk Management

    Uploaded by

    --bolabola
    The document discusses enterprise risk management (ERM) and its importance. It defines ERM as a process run by an organization's board and management to identify risks, manage them within the organization's risk appetite, and provide assurance that objectives are met. ERM supports value creation by helping management deal with future uncertainties and respond in a way that mitigates downside risks and increases upside opportunities. The document then outlines the key components of COSO's ERM framework, including objective setting, risk identification, risk assessment, risk response, control activities, information/communication, and monitoring.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Chapter 6 - Risk Management

    Uploaded by

    --bolabola
    73 views76 pages
    The document discusses enterprise risk management (ERM) and its importance. It defines ERM as a process run by an organization's board and management to identify risks, manage them within the organization's risk appetite, and provide assurance that objectives are met. ERM supports value creation by helping management deal with future uncertainties and respond in a way that mitigates downside risks and increases upside opportunities. The document then outlines the key components of COSO's ERM framework, including objective setting, risk identification, risk assessment, risk response, control activities, information/communication, and monitoring.

    Original Title

    Chapter_6_-_Risk_Management

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses enterprise risk management (ERM) and its importance. It defines ERM as a process run by an organization's board and management to identify risks, manage them within the organization's risk appetite, and provide assurance that objectives are met. ERM supports value creation by helping management deal with future uncertainties and respond in a way that mitigates downside risks and increases upside opportunities. The document then outlines the key components of COSO's ERM framework, including objective setting, risk identification, risk assessment, risk response, control activities, information/communication, and monitoring.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    73 views76 pages

    Chapter 6 - Risk Management

    Uploaded by

    --bolabola
    The document discusses enterprise risk management (ERM) and its importance. It defines ERM as a process run by an organization's board and management to identify risks, manage them within the organization's risk appetite, and provide assurance that objectives are met. ERM supports value creation by helping management deal with future uncertainties and respond in a way that mitigates downside risks and increases upside opportunities. The document then outlines the key components of COSO's ERM framework, including objective setting, risk identification, risk assessment, risk response, control activities, information/communication, and monitoring.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    You are on page 1of 76

    RISK MANAGEMENT

    CHAPTER 6
    ERM Defined:
    “… a process, effected by an entity's board of
    directors, management and other personnel,
    applied in strategy setting and across the
    enterprise, designed to identify potential
    events that may affect the entity, and manage
    risks to be within its risk appetite, to provide
    reasonable assurance regarding the
    achievement of entity objectives.”
    Why ERM Is Important
    Underlying principles:

     Every entity, whether for-profit


    or not, exists to realize value for
    its stakeholders.

     Value is created, preserved, or eroded by


    management decisions in all activities,
    from setting strategy to operating the
    enterprise day-to-day.
    Why ERM Is Important

    ERM supports value creation by enabling


    management to:
     
     Deal effectively with potential future events that create uncertainty.

     Respond in a manner that reduces the likelihood of downside outcomes


    and increases the upside.
    Enterprise Risk Management —
    Integrated Framework

    This COSO ERM framework defines


    essential components, suggests a
    common language, and provides clear
    direction and guidance for enterprise
    risk management.
    The ERM Framework

     Management considers how


    individual risks interrelate.

     Management develops a portfolio view


    from two perspectives:
    - Business unit level
    - Entity level
    The ERM Framework

    Entity objectives can be viewed in the


    context of four categories:
    • Strategic
    • Operations
    • Reporting
    • Compliance
    The ERM Framework

    ERM considers activities at all levels


    of the organization:
    • Enterprise-level
    • Division or
    subsidiary
    • Business unit
    processes
    The ERM Framework

    The eight components


    of the framework
    are interrelated …
    Internal Environment
     Establishes a philosophy regarding risk
    management. It recognizes that unexpected
    as well as expected events may occur.

     Establishes the entity’s risk culture.

     Considers all other aspects of how the


    organization’s actions may affect its risk
    culture.
    Objective Setting
    • Is applied when management considers
    risks strategy in the setting of
    objectives.

    • Forms the risk appetite of the entity —


    a high-level view of how much risk
    management and the board are willing
    to accept.

    • Risk tolerance, the acceptable level of


    variation around objectives, is aligned
    with risk appetite.
    Event Identification
    • Differentiates risks and opportunities.

    • Events that may have a negative impact


    represent risks.

    • Events that may have a positive impact


    represent natural offsets
    (opportunities), which management
    channels back to strategy setting.
    Event Identification

    • Involves identifying those incidents, occurring


    internally or externally, that could affect
    strategy and achievement of objectives.

    • Addresses how internal and external factors


    combine and interact to influence the risk
    profile.
    Risk Assessment
    • Allows an entity to understand the extent
    to which potential events might impact
    objectives.

    • Assesses risks from two perspectives:


    - Likelihood
    - Impact

    • Is used to assess risks and is normally also


    used to measure the related objectives.
    Risk Assessment

    • Employs a combination of both


    qualitative and quantitative risk
    assessment methodologies.

    • Relates time horizons to objective


    horizons.

    • Assesses risk on both an inherent and a


    residual basis.
    Risk Response
    • Identifies and evaluates possible
    responses to risk.

    • Evaluates options in relation to entity’s


    risk appetite, cost vs. benefit of
    potential risk responses, and degree to
    which a response will reduce impact
    and/or likelihood.

    • Selects and executes response based on


    evaluation of the portfolio of risks and
    responses.
    Control Activities
    • Policies and procedures that help ensure
    that the risk responses, as well as other
    entity directives, are carried out.

    • Occur throughout the organization, at


    all levels and in all functions.

    • Include application and general


    information technology controls.
    Information & Communication

     Management identifies, captures, and


    communicates pertinent information in
    a form and timeframe that enables
    people to carry out their
    responsibilities.

     Communication occurs in a broader


    sense, flowing down, across, and up
    the organization.
    Monitoring

    Effectiveness of the other ERM


    components is monitored through:

     Ongoing monitoring activities.

     Separate evaluations.

     A combination of the two.


    The ERM Framework

    Enterprise risk management


    requires an entity to take a
    portfolio view of risk.
    Key Implementation Factors
    1. Organizational design of business
    2. Establishing an ERM organization
    3. Performing risk assessments
    4. Determining overall risk appetite
    5. Identifying risk responses
    6. Communication of risk results
    7. Monitoring
    8. Oversight & periodic review
    by management
    Organizational Design

     Strategies of the business


     Key business objectives
     Related objectives that cascade
    down the organization from key business
    objectives
     Assignment of responsibilities to
    organizational elements and leaders
    (linkage)
    Example: Linkage
     Mission – To provide high-quality accessible
    and affordable community-based health care

     Strategic Objective – To be the first


    or second largest, full-service health
    care provider in mid-size metropolitan markets

     Related Objective – To initiate


    dialogue with leadership of 10 top under-
    performing hospitals and negotiate agreements
    with two this year
    Establish ERM
     Determine a risk philosophy

     Survey risk culture

     Consider organizational integrity


    and ethical values

     Decide roles and responsibilities


    Risk and the Importance of a Risk Assessment

     What is a Risk Assessment?


    A Risk Assessment involves the
    identification and analysis of relevant
    risks that threaten the achievement of an
    organization’s objectives, and to
    determine how those risks should be
    managed

    Presented by Paragon Audit & Consulting 33


    Example: Risk Model
    Environmental Risks
    • Capital Availability
    • Regulatory, Political, and Legal
    • Financial Markets and Shareholder Relations

    Process Risks
    • Operations Risk
    • Empowerment Risk
    • Information Processing / Technology Risk
    • Integrity Risk
    • Financial Risk

    Information for Decision Making


    • Operational Risk
    • Financial Risk
    • Strategic Risk
    Risk and the Importance of a Risk Assessment

     Why is a Risk Assessment Important?


     Proactive approach to removing potential barriers
    threatening the success of an organization
     Helps an organization focus resources
     Required by COSO
     IIAPerformance Standard 2010: the CAE should
    determine the priorities of the internal audit activity
    consistent with the organization’s goals, and based on a
    risk assessment

    35
    Key Steps in Performing a Risk Assessment

    Phase One: Create an Audit Universe Map


     Recognizing the nature of the company, identify and
    document:
     All Business Units or Departments
     Key Processes
     Supporting IT Infrastructure
     Determine auditable entities and segment by (1) Business
    process, (2) Physical location, and (3) IT systems
     Discussions with management to understand emerging
    risks and to discuss prominent risk factors for each entity
    37
    Key Steps in Performing a Risk Assessment
    Phase Two: Identify Objectives and Risks
     Always start with the Organization’s Objectives
     Determine whether Objectives are in line with the
    organization’s mission and vision
     Interview employees and do some on-site observations
     Review key metrics, trends, processes and documentation
     Examine the quality of management
     Analyze the Risk Factors disclosed in the annual 10-K filing
     Review the external factors and recent problems
    identified at other companies
    38
    Key Steps in Performing a Risk Assessment
    Phase Two: Identify Objectives and Risks
    (Continued)
     During discussions with Management, inquire
    about recent or upcoming changes in the
    following:
     Regulatory environment
     Technology

     Management

     Lines of business or business acquisitions/divestitures


     Risk Appetite
    39
     Any known or projected economic factors
    Key Steps in Performing a Risk Assessment
     Phase Three: Rate and Rank Risks
     Complete interviews with the IA Team, Corporate
    Compliance, Senior Management and the External Auditors
     Identify current means by which management mitigates
    risks
     Document Key Inherent Risks, Mitigating Controls and the
    Residual Risks
     Design a measurement system for Likelihood and Impact
    of identified risks and give consideration to Vulnerability
     Work with Senior management to rate and rank key risks
     Compare risks across departments and normalize outliers
    40
    RISK ASSESSMENT PHASE – RISK RANKING

    Risk ranking is the prioritization of risks that can prevent your


    organization from achieving its goals. Risks are evaluated on
    likelihood of occurrence and impact.

    Ranking organizational risk:


    • Determine what constitutes high, medium and low likelihood
    of occurrence
    • Define what constitutes high, medium and low impact (could
    be defined in terms of financial materiality, legal risk, damage
    to reputation, etc.)
    • Prepare a summary and rating of risks

    | 41
    DETERMINE RISK APPETITE
     Riskappetite is the amount of risk — on a
    broad level — an entity is willing to accept in
    pursuit of value.

     Use quantitative or qualitative terms (e.g.


    earnings at risk vs. reputation risk), and
    consider risk tolerance (range of acceptable
    variation).
    DETERMINE RISK APPETITE
    Key questions:

     What risks will the organization not accept?


    (e.g. environmental or quality compromises)

     What risks will the organization take on new


    initiatives?
    (e.g. new product lines)

     What risks will the organization accept for


    competing objectives?
    (e.g. gross profit vs. market share?)
    LIKELIHOOD AND IMPACT

    Risk ranking categories help assess the likelihood and significance (potential impact)
    of inherent risks. Risk rankings should be frequently evaluated.

    • Likelihood
    o High - Probable
    o Medium - Reasonably possible
    o Low - Remote
    • Significance (Impact)
    o High - Material
    o Medium - Significant
    o Low - Immaterial
    IDENTIFY RISK RESPONSES
     Quantification of risk exposure

     Options available:
    - Accept = monitor
    - Avoid = eliminate (get out of situation)

    - Reduce = institute controls


    - Share = partner with someone
    (e.g. insurance)

     Residual risk (unmitigated risk – e.g. shrinkage)


    Impact vs. Probability

    High Medium Risk High Risk

    I
    M Share Mitigate & Control
    P
    A Low Risk Medium Risk
    C
    T
    Accept Control

    Low PROBABILITY High


    RISK ASSESSMENT PHASE – RISK RANKING
    (CONT.) Risk Factors – Likelihood
     Probability of potential problem, loss
    Risk Factors – Impact or missed opportunity
     Effect on goals achievement  Potential timeframe for undesirable
     Financial amounts at risk outcome
     Management concerns
     Regulatory compliance and system
    compliance  Operations structure, changes and

    complexity
    Health and/or safety
     Regulatory changes
     Billing and revenue capture exposures
     Financial incentives
     Cost or operational concerns
     Past issues
     Contractual compliance
     Asset liquidity

    | 56
    Communicating the Risk Assessment to the
    Audit Committee
    Externa
    l
    Factors
    Control Dept.
    Structur Leader
    e s

    Risk
    Externa Assessmen
    l t Key
    Auditor Changes
    s

    Key
    Board of
    Metrics
    Director
    s &
    Trends
    57
    Communicating the Risk Assessment to the Audit
    Committee
     Present an overview of the risk assessment process by
    highlighting the key steps followed in the three Phases
     Phase One: Create an Audit Universe Map
     Phase Two: Identify Objectives and Risks
     Phase Three: Rate and Rank Risks
     Develop a summary of the most significant risks
     Categorize risks into financial, operational, and compliance
     Consider staying under 20 risk categories and discuss sub risks
     Consider using a heat map if not too busy
     One with Inherent risks and one with Residual risks
     Include risk response and linkage to the audit plan
    58
    Monitor
     Collect and display information

     Perform analysis
    - Risks are being properly addressed
    - Controls are working to mitigate risks
    STRUCTURE MONITORING CYCLE
    EXAMPLE
    Internal Audit and
    Controls Compliance Plan

    Stakeholder Assurance of
    Controls Implementation Perform Internal Audits,
    Risk Assessment and
    • Reliable Financial Reporting Oversee Controls Compliance
    Risk Mitigation Strategy • Mitigate Risk of Loss and Controls Override Activities and Report Results
    • Operations Effectiveness and Efficiency

    Follow Up on Internal
    Audit Recommendations
    and Monitor Controls
    Compliance Actions
    | 60
    ERM Roles & Responsibilities

     Management

     The board of directors

     Internal auditors
    Internal Auditors
     Playan important role in monitoring ERM, but do
    NOT have primary responsibility for its
    implementation
    or maintenance.

     Assist
    management and the board or audit
    committee in the process by:
    - Monitoring - Evaluating
    - Examining - Reporting
    - Recommending improvements
    Internal audit’s role in ERM

    Note: This diagram is taken from HB 158-2010 Delivering assurance based on ISO 31000:2009 Risk management, and is itself based on a diagram in a
    position statement released by the Institute of Internal Auditors – UK and Ireland in September 2004 on The Role of Internal Audit in Enterprise-wide Risk
    Management.
    Broadleaf’s view is that the tasks in the dark-blue section of the fan should be separated from internal audit. Within most organizations there is a clear
    conflict of interest between internal audit and risk management in these areas. Some of the specific roles and activities that may lead to conflicts of interest
    are noted in Table 1. 74

    Assurance Can Be Demonstrated Through Multiple

    You might also like