Chapter 9 - Risk Management And Corporate Governance

Question 1

What is the responsibility of the board of directors for risk?

Answer 1

The board has overall responsibility for risk management, and:

• decides risk appetite
• monitors the performance of management in managing within appetite
• monitors the risk management system for effectiveness

Question 2

What is risk appetite and risk tolerance?

Answer 2

Appetite - the level of risk the company is willing to take in pursuing its objectives
Tolerance - amount of financial risk, expressed as a quantitative measure

Question 3

What may be the consequences of failing to consider business risk strategy or establish an effective risk management system?

Answer 3

Companies may be hit by consequences that they did not expect, leading to negative impacts.

Question 4

What is business risk?

Answer 4

Business risk is the combination of strategic risk and operating risk.

Question 5

What is strategic risk?

Answer 5

Risk associated with the external business environment within which a company operates.

Question 6

What is operating risk?

Answer 6

Risk of losses through ineffective internal controls.

Question 7

What are the 5 categories of strategic risk?

Answer 7

1) Reputation risk
2) Competition risk
3) Business environment risks
4) Risks from eternal events
5) Liquidity risk

Question 8

What is the difference between a risk committee of the board and a risk management committee?

Answer 8

A risk committee is a board committee responsible for high-level risk matter such as appetite. A risk management committee is an executive group of managers responsible for risk management.

Question 9

What are the benefits of having a separate risk committee, rather than having the audit committee deal with risk?

Answer 9

• not distracted by none-risk work such as audit

- not constrained by composition rules of the UKCGC

Question 10

What is the advice of the ICSA Guidance on ToR for the risk committee with regards to committee composition?

Answer 10

• majority NEDs
• chairman should be a NED
• CFO should be a member, or should regularly attend
• must be good communication with the audit committee

Question 11

What are the responsibilities of the audit committee for business risk management?

Answer 11

At board level, responsibility for reviewing the effectiveness of the risk management system may be delegated to the audit committee.

Question 12

What are the principles of the UK Code with regard to risk management?

Answer 12

• the board is responsible for determining the nature and extent of the principle risks it is willing to take.
• the board should maintain a sounds system of risk management and internal control.

Question 13

What are the 8 elements of a business risk management system according to COSO?

Answer 13

1 Internal environment
2 Objective setting
3 Risk identification
4 Risk assessment
5 Risk response
6 Control activities
7 Information and communication
8 Monitoring

Question 14

What is a risk register?

Answer 14

A record of risks, actions taken to investigate the risk, and measures taken to deal with it.

Question 15

What is the purpose of stress testing?

Answer 15

Stress testing is a means of assessing a company’s ability to withstand severe shocks, allowing identification of measures to reduce risk.

Question 16

What are the possible response to strategic risks? (4Ts)

Answer 16

Tolerate (no action)
Transfer (e.g. JVs, insurance)
Trim (reduce probability)
Terminate (withdraw from business)

Question 17

How might executive rewards be adjusted for business risk?

Answer 17

Long-term incentives (3 to 5 years) can encourage executives to look toward long term success, rather than high-risk short term success.