2. Risk Management Strategy Flashcards
What are the 7 steps of CIMA’s Risk Management Strategy model?
- Establish a risk management strategy
- Identify risk areas
- Understand and assess scale of risks
- Develop a risk response strategy
- Implement the strategy and allocate responsibilities
- Implement and monitor the suggested controls
- Review and refine the process and do it again
What should the risk management group do?
Facilitiate and coordinate the overall risk management process, and assign responsibilities
What should the risk management group do?
Facilitiate and coordinate the overall risk management process, and assign responsibilities
What is the role of the risk manager?
Instil a culture of risk awareness throughout the organisation and implement the risk strategy
What is the role of the risk committee?
A group of NEDs who promote the understanding and assessment of risk and facilitate the development of a strategy for dealing with the risks identified
What is a company’s risk appetite?
The amount of risk an entity is willing to accept in pursuit of returns
What does the identifying risk areas step involve?
A risk audit (PESTLE/SWOT) assessing the competitive environment in which the company operates, relevant economic conditions and key stakeholders
What are the 6 key elements of the risk register?
- Title/ID
- Likelihood
- Potential impact
- Risk owner
- Mitigation actions
- Overall risk level
Who could be responsible for setting up and maintaining the risk register?
- Senior management (top down)
- Bottom up lower level staff
- External consultant
- Risk manager (internal)
What are we trying to consider when looking at evaluating the scale of risk?
- Serious enough
- Controllable enough
What 3 methods can be used to quantify risks?
- Probabilities
- Expected values
- Cost benefit analysis
What is the most common method of risk evaluation?
Risk map of impact vs likelihood
What 2 methods can be used to create a risk mapping matrix?
- Regression analysis
- Monte Carlo (What If) analysis
What are the 4 matrix options for a risk response strategy?
- Transfer (high/low)
- Accept (low/low)
- Reduce (low/high)
- Avoid (high/high)
What does Portfolio Theory suggest?
It is less risk to have a diverse source of income, spreading investments via market expansion or diversaification
Who could be used to monitor control effectiveness?
Internal audit
What sort of a process do CIMA suggest that companies view risk management as?
A continual, embedded process
How do COSO define ERM?
A process, led by the board of directors, applied in strategy setting across the organisation, designed to identify potential events that may affect the entity and managing risk to be within the risk appetite, to provide reasonable assurance
What are the 8 components of the COSO 2004 framework?
- Internal environment
- Objective setting
- Event identification
- Risk assessment
- Risk Response
- Control activities
- Information and communication
- Monitoring
What are the 4 objectives of the COSO 2004 framework?
- Strategy (high level goals)
- Operations (effective and efficient resource use)
- Financial Reporting (reliability)
- Compliance
What was the focus of the 2017 COSO update?
ERM in strategic planning and embedding it throughout the organisation
What were the 5 points of the 2017 COSO ERM update?
- Governance and culture
- Strategy and objective setting
- Performance
- Review and revision
- Information, communication and reporting
How does ISO 31000 describe risk?
An iterative process that is part of the organisation’s governance and leadership, considering internal and external factors
What are the 3 clauses of ISO 31000?
- Creating and protecting value
- Risk governance framework
- Risk management process
What are the 3 dimensions that determine the size of the risk cube?
- Seriousness of the threat
- Extent of vulnerability
- Impact of threat if arises
What are the 4 lines of defence in a risk assurance map?
- Fisrt line - managers/policies
- Second line - functions e.g. audit committees
- Third line - independent functions e.g. internal audit
- Fourth line - external providers e.g. government
What is an assurance map?
A tool that provides a structured approach to identifying the main sources and types of assurance in an organisation
What are the 10 suggested points on a strategy map?
- Identify sponsor
- Determine scope (strat/op level)
- Assess level of assurance needed
- Map each assurance provider to defence line
- Identify assurance activities
- Reassess scope in light of activities
- Assess quality of activities
- Assess assurance split by defence lines
- Analyse gaps or overlaps
- Determine a course of action
