Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CGMA Strategic level case study > Core Activity D - Evaluate and mitigate risks > Flashcards

Core Activity D - Evaluate and mitigate risks Flashcards

1
Q

What are the key elements of the risk management cycle ?

A

Identify risks

Assess likelihood and impact

Design and implement internal control system

Check internal controls are appropriate and working

Report to management

Circle back with ongoing improvement and monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What 5 key areas does ERM involve ?

A

Understanding how a business is run by its directors

Strategy for success

Positive and negative risks

Risk response

Information gathered on performance and how it responds to that information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What 5 key areas does ERM involve ?

A

Understanding how a business is run by its directors

Strategy for success

Positive and negative risks

Risk response

Information gathered on performance and how it responds to that information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the two main risk management frameworks ?

A

COSO ERM - Integrating strategy & performance

ISO 31000 - risk management guidelines

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the 5 key components of the COSO ERM framework?

A

Governance & culture

Strategy and objective setting

Performance

Review and revisions

Information, communication and reporting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the four main classifications of risk the portfolio view establishes ?

A

Financial risks
Operation risks
Compliance risks
Customer risks

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Describe the TARA framework

A

Transfer - low/high (insurance)
Accept - low/low
Reduced - high/low
Avoid - high/high

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What stages might the identification of risks go through ?

A

Upside / downside risks

External or internal risks

Strategic or operational risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

How might the process for risk identification look?

A

Determine upside or downside risk

Then determine the source of the risk - ie internal or external

Then determine the level of risk - ie operational or strategic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What international risks are Rotomyne exposed to?

A

PESTEL

Transaction risk

Translation risk

Interest rate risk

Physical risk of uranium theft etc

Credit risk - non paying customers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How might Rotomyne mitigate exchange rate risk ?

A

Hedging via the use of forwards, options and futures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What other international risks exists?

A

National culture

Social grouping

Religious issues

Language

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

How might risks be identified from different areas of the business ?

A

Bottom up identification

Top down risk identification

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What processes might be used to evaluate risks ?

A

Qualitative analysis

Quantitative analysis

Risk mapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What quantitative techniques could be used to assess risk ?

A

Expected value

Standard deviation

Volatility / COV

Normal distribution

Regression / correlation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

When assessing risk how can quantitative analysis be used to see how variables are related ?

A

Regression - analysis to obtain the relationship between two (or more) variables

Correlation / correlation coefficient - to see how strong that relationship is

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

How can sensitivity analysis be more efficiently managed?

A

‘Goal seek function’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How can a simulation be more efficiently managed ?

A

‘What if’ function

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What visual tools can be used to manage risks ?

A

TARA model

Heat risk maps (5x5)

Risk bands .. graphs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the steps for determining risk appetite?

Need to check this - I think appetite is set and tolerance measured! Deloitte example

A

Understanding the

Risk tolerance - (Overall feeling of risk) How much risk are the board willing to tolerate?

Risk appetite - (The amount of risk the organisation is willing to take to achieve its long term objectives) perhaps more specific and always smaller than risk tolerance.

Risk capacity - How much downside risk can the organisation cope with to just survive (Berkshire has almost infinite resources)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Define risk capacity

A

Ability to shoulder the risks facing the organisation in relation to its goals and strategies

The risk capacity allows the organisation to take some risks but provide a cushion against downside risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

How might we gain an understanding of the organisation’s maturity of risk management?

A

Strong processes = greater maturity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the financial and non financial considerations of risk capacity?

A

Are funds available ?
Does the return meet the requirements of the risk ? Economic spread

Reputation risk
Political risk
Infrastructure
Staff and knowledge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What’s the definition of risk tolerance?

A

The acceptable level of variation relative to the achievement of a specific objective

Risk appetite is broad, risk tolerance is tactical and operational and often measured

25
Q

What’s the definition of risk appetite?

A

The amount of risk, on a broad level, that an organisation is willing to accept in persuite of value

26
Q

Risk definitions

A

My current understanding is that risk capacity is what the organisation is willing to absorb

Risk appetite is broad/ maxi min etc

Risk tolerance is subjective to a specific detail of the particular project ..

Both linked to performance over time

27
Q

How might the organisation document all identified risks ?

A

Via a risk register document

Included will be ‘risk mitigating control actions’

28
Q

What techniques could be used to analyse external risk ?

A

PESTEL analysis

Porters five forces

29
Q

What techniques could be used to identify internal risks ?

A

9ms model

Value chain

30
Q

What stages are they is strategy whereby risks should be identified?

A

Type of strategy - cost leadership / differentiation

Product market strategy - ansoffs matrix

Operational infrastructure

Method of growth

31
Q

What does strategy formulation and risk registers have in common ?

A

They are constant and always being reviewed in an ever changing environment

32
Q

Once an organisation has determined its risk appetite, what techniques may it use to mitigate identified risks?

A

Scenario planning

Stress testing

33
Q

What does strategy formulation and risk registers have in common ?

A

They are constant and always being reviewed in an ever changing environment

34
Q

What should an organisation also implement alongside ERM?

A

System of internal controls

35
Q

What should also be be implemented alongside a system of internal control?

A

Internal audit

36
Q

What’s the purpose of internal control?

A

Designed to provide reasonable assurance that the organisations operations, reporting and compliance objectives are achieved

Affected by an entities board of directors and management / other personnel

37
Q

What is meant my internal audit?

A

The internal audit team assist the organisation in maintaining effective internal control by evaluating its effectiveness and efficiency and by promoting continuous improvement

38
Q

What are 2 main purposes of ERM?

A

Reduce likelihood of an event

Manage impact when such an event occurs

39
Q

How does ERM support strategy ?

A

It informs the organisation of risks associated with alternative strategy and also risks associated with the strategy chosen.

40
Q

What’s the definition of cyber risk ?

A

Any possibility of an organisation suffering loss or harm from a failure of its IT system.

41
Q

What’s the definition of a cyber threat ?

A

Any circumstance or event with the potential to adversely affect operation, assets, or individuals through an IT system.

42
Q

What’s the definition of cybersecurity?

A

The process of designing, implementing, and operating controls to protect information and detect / security events that are not prevented.

43
Q

How can we support cybersecurity prevention?

A

Via a Cybersecurity risk management programme

44
Q

What’s the definition of a Data breach ?

A

An event in which confidential data have potentially been viewed, stolen, or used by an individual unauthorised to do so

45
Q

What’s the definition of a bad actor ?

A

Any party that possesses a motive and opportunity to conduct a cyber attack

46
Q

What’s a man in the middle attack?

A

Involves a bad actor intervening in a conversation between 2 parties. The imposter impersonates both parties to gain access to information

47
Q

What does malware stand for ?

A

Malicious software

48
Q

What’s a DOS attack?

A

Denial of service - involves generating large volumes of request that overwhelm the target system.

49
Q

What’s the purpose of the AICPA cybersecurity risk management reporting framework?

A

Transparency

Integrity

Reliability

50
Q

What are the main components of the AICPA reporting framework?

A

Management description

Managements assertion

Independent accountants opinion

51
Q

What’s the three lines of defense model ?

A

Function that own and manage risk

Functions that oversee risk management policies

Functions that provide independent assurance

52
Q

What is the CIA triad ?

A

Cybersecurity model that focuses on

Confidentiality

Integrity

Availability

53
Q

What tolls or techniques can be used to manage cyber security ?

A

Exploiting vulnerability

Reverse engineering

Storage analysis

System level analysis

54
Q

What security standard must a company conform to when developing software ?

A

ISO 27001

55
Q

What are the 5 R/s relating to risk resilience ?

A

Risk radar

Resources

Relationships

Rapid response

Review and adapt

56
Q

How is stress testing different from scenario planning?

A

Scenario planning is used to develop a range of possible outcome based on probability. Stress testing is a layer of protection added on top to determine how these scenarios may play out under different stressful environments .. ie high inflations / high interest rate environment.

57
Q

How else could internal risks be evaluated ?

A

Using the 9m’s model?

Man power - are employees treated fairly?

Machinery - Is our fleet electric or ICE?

58
Q
A

CGMA Strategic level case study (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions