RISK MANAGEMENT

CHAPTER 6
 ERM Defined:
“… a process, effected by an entity's board of
directors, management and other personnel,
applied in strategy setting and across the
enterprise, designed to identify potential
events that may affect the entity, and manage
risks to be within its risk appetite, to provide
reasonable assurance regarding the
achievement of entity objectives.”
 Why ERM Is Important
Underlying principles:

 Every entity, whether for-profit

or not, exists to realize value for
its stakeholders.

 Value is created, preserved, or eroded by

management decisions in all activities,
from setting strategy to operating the
enterprise day-to-day.
 Why ERM Is Important

ERM supports value creation by enabling

management to:
 
 Deal effectively with potential future events that create uncertainty.

 Respond in a manner that reduces the likelihood of downside outcomes

and increases the upside.
 Enterprise Risk Management —
Integrated Framework

This COSO ERM framework defines

essential components, suggests a
common language, and provides clear
direction and guidance for enterprise
risk management.
 The ERM Framework

 Management considers how

individual risks interrelate.

 Management develops a portfolio view

from two perspectives:
- Business unit level
- Entity level
 The ERM Framework

Entity objectives can be viewed in the

context of four categories:
• Strategic
• Operations
• Reporting
• Compliance
 The ERM Framework

ERM considers activities at all levels

of the organization:
• Enterprise-level
• Division or
subsidiary
• Business unit
processes
 The ERM Framework

The eight components

of the framework
are interrelated …
 Internal Environment
 Establishes a philosophy regarding risk
management. It recognizes that unexpected
as well as expected events may occur.

 Establishes the entity’s risk culture.

 Considers all other aspects of how the

organization’s actions may affect its risk
culture.
 Objective Setting
• Is applied when management considers
risks strategy in the setting of
objectives.

• Forms the risk appetite of the entity —

a high-level view of how much risk
management and the board are willing
to accept.

• Risk tolerance, the acceptable level of

variation around objectives, is aligned
with risk appetite.
 Event Identification
• Differentiates risks and opportunities.

• Events that may have a negative impact

represent risks.

• Events that may have a positive impact

represent natural offsets
(opportunities), which management
channels back to strategy setting.
 Event Identification

• Involves identifying those incidents, occurring

internally or externally, that could affect
strategy and achievement of objectives.

• Addresses how internal and external factors

combine and interact to influence the risk
profile.
 Risk Assessment
• Allows an entity to understand the extent
to which potential events might impact
objectives.

• Assesses risks from two perspectives:

- Likelihood
- Impact

• Is used to assess risks and is normally also

used to measure the related objectives.
 Risk Assessment

• Employs a combination of both

qualitative and quantitative risk
assessment methodologies.

• Relates time horizons to objective

horizons.

• Assesses risk on both an inherent and a

residual basis.
 Risk Response
• Identifies and evaluates possible
responses to risk.

• Evaluates options in relation to entity’s

risk appetite, cost vs. benefit of
potential risk responses, and degree to
which a response will reduce impact
and/or likelihood.

• Selects and executes response based on

evaluation of the portfolio of risks and
responses.
 Control Activities
• Policies and procedures that help ensure
that the risk responses, as well as other
entity directives, are carried out.

• Occur throughout the organization, at

all levels and in all functions.

• Include application and general

information technology controls.
 Information & Communication

 Management identifies, captures, and

communicates pertinent information in
a form and timeframe that enables
people to carry out their
responsibilities.

 Communication occurs in a broader

sense, flowing down, across, and up
the organization.
 Monitoring

Effectiveness of the other ERM

components is monitored through:

 Ongoing monitoring activities.

 Separate evaluations.

 A combination of the two.

 The ERM Framework

Enterprise risk management

requires an entity to take a
portfolio view of risk.
 Key Implementation Factors
1. Organizational design of business
2. Establishing an ERM organization
3. Performing risk assessments
4. Determining overall risk appetite
5. Identifying risk responses
6. Communication of risk results
7. Monitoring
8. Oversight & periodic review
by management
 Organizational Design

 Strategies of the business

 Key business objectives
 Related objectives that cascade
down the organization from key business
objectives
 Assignment of responsibilities to
organizational elements and leaders
(linkage)
 Example: Linkage
 Mission – To provide high-quality accessible
and affordable community-based health care

 Strategic Objective – To be the first

or second largest, full-service health
care provider in mid-size metropolitan markets

 Related Objective – To initiate

dialogue with leadership of 10 top under-
performing hospitals and negotiate agreements
with two this year
 Establish ERM
 Determine a risk philosophy

 Survey risk culture

 Consider organizational integrity

and ethical values

 Decide roles and responsibilities

 Risk and the Importance of a Risk Assessment

 What is a Risk Assessment?

A Risk Assessment involves the
identification and analysis of relevant
risks that threaten the achievement of an
organization’s objectives, and to
determine how those risks should be
managed

Presented by Paragon Audit & Consulting 33

 Example: Risk Model
Environmental Risks
• Capital Availability
• Regulatory, Political, and Legal
• Financial Markets and Shareholder Relations

Process Risks
• Operations Risk
• Empowerment Risk
• Information Processing / Technology Risk
• Integrity Risk
• Financial Risk

Information for Decision Making

• Operational Risk
• Financial Risk
• Strategic Risk
 Risk and the Importance of a Risk Assessment

 Why is a Risk Assessment Important?

 Proactive approach to removing potential barriers
threatening the success of an organization
 Helps an organization focus resources
 Required by COSO
 IIAPerformance Standard 2010: the CAE should
determine the priorities of the internal audit activity
consistent with the organization’s goals, and based on a
risk assessment

35
 Key Steps in Performing a Risk Assessment

Phase One: Create an Audit Universe Map

 Recognizing the nature of the company, identify and
document:
 All Business Units or Departments
 Key Processes
 Supporting IT Infrastructure
 Determine auditable entities and segment by (1) Business
process, (2) Physical location, and (3) IT systems
 Discussions with management to understand emerging
risks and to discuss prominent risk factors for each entity
37
 Key Steps in Performing a Risk Assessment
Phase Two: Identify Objectives and Risks
 Always start with the Organization’s Objectives
 Determine whether Objectives are in line with the
organization’s mission and vision
 Interview employees and do some on-site observations
 Review key metrics, trends, processes and documentation
 Examine the quality of management
 Analyze the Risk Factors disclosed in the annual 10-K filing
 Review the external factors and recent problems
identified at other companies
38
 Key Steps in Performing a Risk Assessment
Phase Two: Identify Objectives and Risks
(Continued)
 During discussions with Management, inquire
about recent or upcoming changes in the
following:
 Regulatory environment
 Technology

 Management

 Lines of business or business acquisitions/divestitures

 Risk Appetite
39
 Any known or projected economic factors
 Key Steps in Performing a Risk Assessment
 Phase Three: Rate and Rank Risks
 Complete interviews with the IA Team, Corporate
Compliance, Senior Management and the External Auditors
 Identify current means by which management mitigates
risks
 Document Key Inherent Risks, Mitigating Controls and the
Residual Risks
 Design a measurement system for Likelihood and Impact
of identified risks and give consideration to Vulnerability
 Work with Senior management to rate and rank key risks
 Compare risks across departments and normalize outliers
40
RISK ASSESSMENT PHASE – RISK RANKING

Risk ranking is the prioritization of risks that can prevent your

organization from achieving its goals. Risks are evaluated on
likelihood of occurrence and impact.

Ranking organizational risk:

• Determine what constitutes high, medium and low likelihood
of occurrence
• Define what constitutes high, medium and low impact (could
be defined in terms of financial materiality, legal risk, damage
to reputation, etc.)
• Prepare a summary and rating of risks

| 41
 DETERMINE RISK APPETITE
 Riskappetite is the amount of risk — on a
broad level — an entity is willing to accept in
pursuit of value.

 Use quantitative or qualitative terms (e.g.

earnings at risk vs. reputation risk), and
consider risk tolerance (range of acceptable
variation).
 DETERMINE RISK APPETITE
Key questions:

 What risks will the organization not accept?

(e.g. environmental or quality compromises)

 What risks will the organization take on new

initiatives?
(e.g. new product lines)

 What risks will the organization accept for

competing objectives?
(e.g. gross profit vs. market share?)
LIKELIHOOD AND IMPACT

Risk ranking categories help assess the likelihood and significance (potential impact)
of inherent risks. Risk rankings should be frequently evaluated.

• Likelihood
o High - Probable
o Medium - Reasonably possible
o Low - Remote
• Significance (Impact)
o High - Material
o Medium - Significant
o Low - Immaterial
 IDENTIFY RISK RESPONSES
 Quantification of risk exposure

 Options available:
- Accept = monitor
- Avoid = eliminate (get out of situation)

- Reduce = institute controls

- Share = partner with someone
(e.g. insurance)

 Residual risk (unmitigated risk – e.g. shrinkage)

Impact vs. Probability

High Medium Risk High Risk

I
M Share Mitigate & Control
P
A Low Risk Medium Risk
C
T
Accept Control

Low PROBABILITY High

RISK ASSESSMENT PHASE – RISK RANKING
(CONT.) Risk Factors – Likelihood
 Probability of potential problem, loss
Risk Factors – Impact or missed opportunity
 Effect on goals achievement  Potential timeframe for undesirable
 Financial amounts at risk outcome
 Management concerns
 Regulatory compliance and system
compliance  Operations structure, changes and

complexity
Health and/or safety
 Regulatory changes
 Billing and revenue capture exposures
 Financial incentives
 Cost or operational concerns
 Past issues
 Contractual compliance
 Asset liquidity

| 56
Communicating the Risk Assessment to the
Audit Committee
Externa
l
Factors
Control Dept.
Structur Leader
e s

Risk
Externa Assessmen
l t Key
Auditor Changes
s

Key
Board of
Metrics
Director
s &
Trends
57
Communicating the Risk Assessment to the Audit
Committee
 Present an overview of the risk assessment process by
highlighting the key steps followed in the three Phases
 Phase One: Create an Audit Universe Map
 Phase Two: Identify Objectives and Risks
 Phase Three: Rate and Rank Risks
 Develop a summary of the most significant risks
 Categorize risks into financial, operational, and compliance
 Consider staying under 20 risk categories and discuss sub risks
 Consider using a heat map if not too busy
 One with Inherent risks and one with Residual risks
 Include risk response and linkage to the audit plan
58
 Monitor
 Collect and display information

 Perform analysis
- Risks are being properly addressed
- Controls are working to mitigate risks
STRUCTURE MONITORING CYCLE
EXAMPLE
Internal Audit and
Controls Compliance Plan

Stakeholder Assurance of
Controls Implementation Perform Internal Audits,
Risk Assessment and
• Reliable Financial Reporting Oversee Controls Compliance
Risk Mitigation Strategy • Mitigate Risk of Loss and Controls Override Activities and Report Results
• Operations Effectiveness and Efficiency

Follow Up on Internal
Audit Recommendations
and Monitor Controls
Compliance Actions
| 60
ERM Roles & Responsibilities

 Management

 The board of directors

 Internal auditors
 Internal Auditors
 Playan important role in monitoring ERM, but do
NOT have primary responsibility for its
implementation
or maintenance.

 Assist
management and the board or audit
committee in the process by:
- Monitoring - Evaluating
- Examining - Reporting
- Recommending improvements
Internal audit’s role in ERM

Note: This diagram is taken from HB 158-2010 Delivering assurance based on ISO 31000:2009 Risk management, and is itself based on a diagram in a
position statement released by the Institute of Internal Auditors – UK and Ireland in September 2004 on The Role of Internal Audit in Enterprise-wide Risk
Management.
Broadleaf’s view is that the tasks in the dark-blue section of the fan should be separated from internal audit. Within most organizations there is a clear
conflict of interest between internal audit and risk management in these areas. Some of the specific roles and activities that may lead to conflicts of interest
are noted in Table 1. 74

Assurance Can Be Demonstrated Through Multiple