Ch1 Enterprise Risk Management (ERM)

Question 1

Risk inventories

Answer 1

1. Strategic risks
2. Operational risks
3. Reporting risks
4. Compliance risks
5. Other categories: leadership, reputation, health and safety, firm value

Question 2

ERM

Answer 2

1. Identification
2. Assessment
3. Risk response
4. Internal control activities
5. Information and communication
6. Monitoring

Question 3

Techniques to assess risks

Answer 3

• benchmarking: external comparison to industry peers or other industries
• probabilistic models: using past data and artificial intelligence to make predictions about future performance
• sensitivity models: surveying the results of a number of variables to study the uncertainty of those inputs
• scenario analysis: also referred to as “what-if” analysis, it describes the estimated outcome if a certain situation were to take place

(likelihood and impact - two key factors) - heat map

Question 4

Risk response

Answer 4

(Risk appetite and strategic goals)
* Avoidance — The company doesn’t take on the risk and forfeits the potential benefits. This is a good strategy when the benefits are small or infrequent, given the potential risks and costs.
* Reduction — The company takes the risk, but tries to reduce the total exposure to the risk. This is done by introducing controls or processes.
* Transferring — The company accepts the risk, but does not bear the entire risk on its own. The organization will transfer or share the risk with other parties. Common risk-sharing techniques include purchasing insurance products, pooling risks, engaging in hedging transactions, or outsourcing an activity.
* Acceptance — The company takes on the risk and accepts the potential consequences, as the company has evaluated that the potential benefits outweigh the costs.

Contingency plan - a formal process to understand and respond risk

Question 5

Contingency planning

Answer 5

Identify risks
Prioritize risks
Develop a plan
Maintain the plan

Question 6

Internal control actvities

Answer 6

Inherent risk + Control activities = Residule risk

examples of common control activities include:
* managerial review of information
* information processing controls over accuracy, completeness, and authorization of transactions
* enforcement of company policies including vacations, as having employees substitute in each other’s roles can assist in catching business irregularities
* physical controls that are designed to safeguard assets
* segregation of duties to ensure that no single individual initiates, authorizes, and processes a transaction