Chapter 4 Flashcards
The culture, capabilities, and practices, integrated with strategy-setting, that organizations rely on to manage risk in creating, preserving, and realizing value.
Enterprise Risk Management (ERM)
The entity’s core purpose, which establishes what it wants to accomplish and why it exists.
Mission
The entity’s aspirations for its future state or what the organization aims to achieve over time.
Vision
The entity’s beliefs and ideals about what is good or bad, acceptable or unacceptable, which influence the behavior of the organization.
Core Values
The organization’s plan to achieve its mission and vision and apply its core values.
Strategy
Those measurable steps the organization takes to achieve its strategy.
Business Objectives
The COSO exposure draft describes these five risk components as follows
- Risk Governance
- Risk, Strategy; and objective setting
- Risk in execution.
- Risk information communication and reporting
- Monitoring enterprise risk management performance.
The types and amount of risk, on a broad level, an organization is willing to accept in pursuit of value.
Risk Appetite
The ISO risk management process is comprised of the following activities:
- Establish the context
- assess the risk
- treat the risk
- Monitor risk
- establish a communication and consultation process
The combination of internal and external risk factors in their pure uncontrolled state or the gross risk that exists, assuming there are no internal controls in place.
Inherent risk
The portion of inherent risk that remains after management execute, its risk responses sometimes referred to as net risk
Residual risk
Coso five categories of risk response are 
except, avoid, pursue, reduce, share 
Giving assurance on risk management processes
Giving assurance that risk are correctly evaluated
Evaluating risk management processes,
Evaluating the reporting key risk
Reviewing the management of key risks
Core internal audit roles in regard to ERM
Facilitating, identification and evaluation of risks
Coaching management in responding to Ris
Coordinating ERM activities
Consolidated reporting on risks
Maintaining and developing the ERMframework
Championing Establishment of ERM
Developing ER strategy for board approval 
Legitimate internal audit rules with safeguards 
Setting the risk appetite
Imposing risk management process
Management assurance on risks
Taking decisions on risk responses
Implementing risk responses on managers behalf
Accountability for risk management 
Rolls internal audit should not undertake 
