3 - Roles and responsibility

Question 1

The approach adopted by enterprise risk management is BEST described as being:

Answer 1

holistic

Question 2

In the UK, certain companies are required to disclose in their annual reports and accounts how they have complied with the Corporate Governance Code. This requirement would apply to what type of company?

Answer 2

Sha Manufacturing plc.

Question 3

The risk tolerance of a firm describes the:

Answer 3

risks that the firm might be able to bear.

Question 4

A claims manager has been asked by the risk management department to review whether the claims settlement authorities granted to claims handlers are being followed and to report his findings to them. What type of risk management technique is being used?

Answer 4

Control self assessment.

Question 5

What is an advantage to an organisation of having a successful enterprise risk management programme?

Answer 5

An improved competitive advantage.

NOT
There is little risk monitoring required.
The ability to look at risks individually.
Rapid changes to the risk culture of the organisation.

Question 6

The MAIN purpose of an internal audit of risk management is to:

Answer 6

provide independent assurance to the board that an effective risk management system is in place and operating effectively.

Question 7

The UK Corporate Governance Code SPECIFICALLY charges company directors with:

Answer 7

supervising the management of the business.

Question 8

What responsibilities is a risk officer employed by a large manufacturer likely to have?

Answer 8

Identifying, analysing and evaluating a range of individual risks in specific areas.

Question 9

In a major UK insurer, who will typically be responsible for agreeing, establishing and overseeing a risk management framework across the organisation?

Answer 9

Chief risk officer.

Question 10

In a five stage model of risk maturity, an example of level five would include having:

Answer 10

policies that define all aspects of risk management and governance.

Question 11

One of the five main responsibilities of a board of directors concerns risk. Under this heading, what is the board responsible for?

Answer 11

Supervision of the process of risk assessment and ensuring necessary actions are adopted to mitigate against those risks.

Question 12

Organisations may consider integrating audit, compliance and risk management activities in a single GRC (Governance, Risk and Compliance) system. What are they hoping to achieve?

Answer 12

GRC is expected to improve governance and efficiency by aligning strategy, processes, technology and people

Question 13

Overall management and direction of any organisation is the responsibility of a …

Answer 13

small group of people who accept certain roles and responsibilities in line with corporate legislation.

Question 14

A board cannot ignore its responsibilities regarding risk management. It needs to …

Answer 14

specify risk policy, thoroughly review risk exposures and define levels of risk it is prepared to accommodate.

Question 15

A common approach with regards to supervising risk is to appoint a …

Answer 15

Risk subcommittee

Question 16

The risk subcommittee will act with what authority?

Answer 16

board authority, setting policies and making risk decisions as required.

Question 17

The way a board sets up an organisation to achieve its objectives, together with the systems it puts in place to manage and control that organisation, is known as

Answer 17

Corporate governance

Question 18

The UK Corporate Governance Code provides a code of best practice for companies listed on the …

Answer 18

London Stock Exchange. It is overseen by the Financial Reporting Council.

Question 19

SOX established …

Answer 19

enhanced standards for all LJIS public companies listed by the financial regulator.

Question 20

CSA is

Answer 20

a systematic process requiring management and staff to continually audit and report on risks and risk controls for which they are responsible. Improved awareness and accountability for risk leads to better corporate governance.

Question 21

What is Enterprise Risk Management?

Answer 21

The structure set up to control risk management across the whole organisation is known as enterprise risk management.

Question 22

ERM systems allow all the risks involved in an organisation to be looked at …

Answer 22

together and from different perspectives. This is known as a holistic approach.

Question 23

ERM has been recognised as an important element of strong …

Answer 23

corporate governance.
Today its use in large organisations is internationally supported by laws, regulations and compliance requirements.

Question 24

The ERM framework is important. It shows how essential functions of an organisation combine to create …

Answer 24

an integrated system for managing risk across the whole organisation.

Question 25

A common source of overlapping responsibilities in large organisations arises from the activities of

Answer 25

risk management, audit and compliance - all responses to particular requirements organisations have been forced to consider.

Question 26

Attempts to create such an integrated structure have become known as

Answer 26

governance, risk and compliance (GRC) frameworks.

Question 27

Organisations with separate risk management, audit and compliance activities have difficulties providing …

Answer 27

coherent (combined) information to the board to improve corporate
governance.

Question 28

An objective of GRC is to

Answer 28

rationalize information gathering and processing structures using common technology to capture, store and process information. Organisation wide training is also required to introduce a common vocabulary across all risk management and assurance functions.

Question 29

GRC is expected to improve governance and efficiency by …

Answer 29

aligning strategy, processes, technology and people.

Question 30

ERM is …

Answer 30

a dynamic management system which states that people be organized and trained to carry out delegated tasks within specified boundaries and specified communication and reporting channels.

Question 31

In a typical ERM system, a group risk management function would be responsible for:

Answer 31

• setting up and maintaining the ERM framework; and
• managing all risk management functions within the group.

Question 32

An ERM function can make a valuable contribution to … (formation)

Answer 32

strategy formation as well as managing risk involved.

Question 33

ERM is a basic management philosophy that can only be initiated and maintained by …

Answer 33

the board, which must deliberately take every opportunity to emphasise ERM’s relevance and importance.

Question 34

Large organisations are typically concerned with two types of audit process:

Answer 34

internal and external.

Question 35

External audits are conducted by

Answer 35

separate professional organisations to give independent assurance to stakeholders that published information conforms to specific standards and is factually correct.

Question 36

Internal audits are carried out within an organisation to provide assurance to

Answer 36

the board that approved systems and procedures are operating as intended.

Question 37

The board expects internal audit to provide assurance regarding what functions?

Answer 37

several key functions, only one of which is risk management.

Question 38

Evaluation of risk exposure is important. The internal audit will be looking to come to an informed opinion about reliability of what? and effectiveness of what?

Answer 38

reliability of information and effectiveness of risk management operations.

Question 39

Organisations whose existence depends on compliance with appropriate laws and regulations often create …

Answer 39

separate compliance function specifically to identify and control threats that might lead to breaches of compliance.

Question 40

Compliance must keep up to date with existing and new legislation affecting any organisation operation. Compliance provides …

Answer 40

policies, guidance, training and advice on compliance issues, as well as assurance that suitable compliance controls are in place and effective.

Question 41

Organisation of a compliance function could mirror the organisation of

Answer 41

Risk Management

Question 42

Compliance activities are a subset of both …

Answer 42

audit and risk management activities, concentrating on a limited number of’ specific, but important risks.

Question 43

Some organisations treat risk control as an integral part of general management, making each manager responsible for

Answer 43

events in their own area of influence.

Question 44

Effective risk management will heavily depend on the ability of …

Answer 44

the central risk management professionals to communicate with and persuade their various management colleagues to treat risk in a coordinated manner.

Question 45

It is difficult, if not impossible, to prevent overlap between various management responsibilities?

Answer 45

True

Question 46

In the final analysis, responsibility for risk control throughout an organisation lies with

Answer 46

the board of directors

Question 47

A risk subcommittee will set out the structure …

Answer 47

by which they intend to manage risk in a written document available for general reference. This is usually referred to as risk management architecture. This document describes the risk management structure of the organisation, laying out lines of communication for reporting risk management issues.

Question 48

The risk management architecture document should be reviewed at least every …

Answer 48

one to two years to reflect major changes in an organisation or its environment.

Question 49

A chief risk officer will contribute to decisions about the …

Answer 49

direction an organisation is to follow and will be intimately involved in the detail of strategic plans. They could be actively or indirectly involved in many diverse issues.

Question 50

Could a risk manager have board status?

Answer 50

A risk manager could have board status in some organisations, a middle management or lesser role in others. In some organisations the role may focus on a particular specialist area of risk.

Question 51

A risk officer is a person who carries out …

Answer 51

selected duties under the guidance and direction of the chief risk officer.

Question 52

In any organisation committees are established as forums to …

Answer 52

bring together experts or representatives from different areas of the organisation to discuss common topics or objectives.

Question 53

Risk appetite is

Answer 53

the amount of risk that an organisation is prepared to accept, tolerate or be exposed to at any point in time.

Question 54

It is important to define risk appetite because?

Answer 54

It is important to define risk appetite and communicate the policy to line managers and decision-making staff.

Question 55

Defining risk appetite provides a framework for

Answer 55

Decision making

Question 56

Risk tolerance describes those risks that the organisation might be able to …

Answer 56

put up with

Question 57

Organisation culture is a collective description reflecting …

Answer 57

typical behavior patterns of people who work there.

Question 58

Various initiatives may be used to enhance risk awareness culture in an organisation.?

Answer 58

True

Question 59

Maintaining risk awareness culture requires

Answer 59

Maintaining this culture will require continuous training support, particularly for new recruits. It will also need a continuous review and monitoring programme to ensure not just that procedures are being followed, but that required results are being achieved.

Question 60

Generally speaking, organisations with effective risk management processes can expect …

Answer 60

less unexpected losses and better selection of future opportunities.

Question 61

A qualitative indication of progress in developing risk awareness in an organisation can be obtained by

Answer 61

by regularly assessing the current: level of risk culture.

Question 62

Processes of observation, audit and interviews are used to evaluate the extent to which risk culture is embedded in what?

Answer 62

is embedded in organisation procedures and practices. The result is a classification in terms of risk maturity, where various levels of maturity are defined by descriptions of different risk control structures and perceived attitudes to management of risk.

Question 63

Do organisations have their own risk maturity models

Answer 63

Yes

Organisations may develop their own risk maturity model for this type of assessment or use one of the general framework models available. A simple model known as the 4Ns is currently being promoted. This has four levels of maturity labelled as naïve, novice, normalized and natural, with corresponding descriptions for each of these levels.

Question 64

It is accepted that greater risk management system maturity reduces the impact of

Answer 64

undesirable events and will reduce risks involved in forward strategies and plans.

Question 65

What is corporate governance?

Answer 65

Corporate governance is the way a board sets up an organisation to achieve its objectives, together with the systems it puts in place to manage and control that organisation.

Question 66

What sort of devices and procedures can be used for internal control?

Answer 66

• approvals;
• authorisations;
• reconciliations;
• separation of duties;
• physical controls;
• IT controls;
• peer reviews.

Question 67

What is ERM and why is it desirable?

Answer 67

ERM is the structure an organisation sets up to control risk management across the whole of its organisation. ERM allows all the risks involved in an organisation to be looked at together and from different perspectives. This is known as a holistic approach.

Question 68

Can you outline a typical organisation structure within an ERM framework?

Answer 68

Heads of departments have primary responsibility for identifying, assessing and managing operational risks in their areas. A group risk management function is responsible for setting up and maintaining the ERM framework, and for coordinating all risk management functions within the group.

Question 69

State five key responsibilities you would expect a chief risk officer to have.

Answer 69

• Ensure risk management is at the heart of strategic decision making.
• Supply appropriate risk management skills and expertise concerning any corporate involvement in major initiatives or programmes.
• Agree, establish and oversee a risk management framework across the
organisation.
• Raise ‘risk awareness’ across the organisation.
• Communicate on risk matters with all business areas and appropriate external stakeholders.
• Ensure all risk owners understand the risk’s they are responsible for.
• Provide advice and support across the organisation to ensure effective risk management.
• Identify risk trends and emerging risks of interest to the organisation.
• Identify, analyze, assess and evaluate a range of individual risks across the organisation.
• Maintain an up-to-date risk register.
• Evaluate existing risk controls - highlighting any deficiencies and creating action plans for improvement.
• Implement cost-effective risk controls or adjustment.
• Identify and report on the most important risks faced by the organisation.
• Prepare insurance programmes and business continuity plans.
• Identify and report on significant changes in probability or impact of the most important risks faced by the organisation.
• Work within agreed budgetary constraints.
• Take overall responsibility for recruitment and development of direct reports including appropriate training.

Question 70

What is the difference between audit and compliance functions?

Answer 70

Compliance is a subset of audit, concentrating on a limited number of important risks, normally those threatening compliance with relevant laws and regulations.

Question 71

What is the difference between risk appetite and risk tolerance?

Answer 71

Risk appetite describes those risks that an organisation is actively willing to take. Risk tolerance describes those risks that: the organisation might be able to put up with. A risk appetite policy can be used as a guide for both new and existing risks.

Question 72

What activities support a risk aware culture?

Answer 72

Activities that support a risk aware culture include leadership, involvement, learning, accountability and communication. Any management device is useful that contributes to the aim of fully embedding risk consideration as an integral part of everyday procedures at all levels in an organisation.

Question 73

UK Corporate Governance Code

Answer 73

The UK Corporate Governance Code provides a code of best practice for companies listed on the London Stock Exchange. It is overseen by the Financial Reporting Council (FRC).