COSO ERM Framework

Question 1

What is the definition for ERM?

Answer 1

The culture, capabilities and practices integrated with strategy-setting and performance, that organization relies on to MANAGE RISK in creating, preserving and realizing VALUE. Effective integration improves decision making and performance.

Question 2

What is culture?

Answer 2

The attitudes, behaviors and understanding about RISK, both positive and negative, that influence the decision of management and personnel and reflect the mission, vision and core values of the organization.

Question 3

What is mission?

Answer 3

The organization’s core purpose.

Question 4

What is vision?

Answer 4

The organization’s aspirations for what it intends to achieve over time.

Question 5

What is core value?

Answer 5

The organization’s essential beliefs about what is acceptable or unacceptable.

Question 6

What are capabilities?

Answer 6

The skills needed to carry out the organization’s mission and vision.

Question 7

What are practices?

Answer 7

The collective methods used to manage risks.

Question 8

What does “integrating strategy setting and performance” mean?

Answer 8

To consider risk in setting strategy, business objectives, performance targets and tolerance.

Question 9

What is strategy?

Answer 9

It communicates how the organization will achieve its mission and vision and how it will apply its core values.

Question 10

What are business objectives?

Answer 10

The steps taken to achieve strategy.

Question 11

What is (risk) tolerance?

Answer 11

The range of acceptable variation in performance results.

Question 12

What is risk profile?

Answer 12

The composite view of the types, severity and interdependencies or risks related to a specific strategy or business objectives and their effect on performance. See Figure 1-3 on p.31.

Question 13

What is portfolio view of risk?

Answer 13

The composite view of the risks related to ENTITY-WIDE strategy and business objectives and their effects on ENTITY performance.

Question 14

What is opportunity in terms of managing risk?

Answer 14

Any action or potential action that creates or alters goals or approaches for the creation, preservation or realization of value. They differ from positive events, occurrences in which performance exceeds the original target.

Question 15

True or False. Effective ERM practices provide absolute assurance that the risk assumed is appropriate.

Answer 15

False. Effective ERM practices provide reasonable expectation that the risk assumed is appropriate.

Question 16

What is risk inventory?

Answer 16

It consists of all identified risks that affect strategy and business objectives.

Question 17

What is risk capacity?

Answer 17

The maximum amount that an organization can assume.

Question 18

What is risk appetite?

Answer 18

The types and amount of risk an organization is willing to accept in order to pursue value.

Question 19

What is inherent risk?

Answer 19

The risk in the absence of management actions to alter its severity.

Question 20

What is actual residual risk?

Answer 20

The risk remaining after management actions to alter its severity.

Question 21

What is target residual risk?

Answer 21

The risk an organization prefers to assume knowing that management actions has or will alter its severity.

Question 22

When is value created?

Answer 22

When benefits obtained from the resources used exceed their costs.

Question 23

When is value preserved?

Answer 23

When resources used are sustained.

Question 24

When is value realized?

Answer 24

When benefits are transferred to stakeholders.

Question 25

When is value eroded?

Answer 25

When management’s strategy doesn’t produce expected results or when management doesn’t perform day-to-day tasks.

Question 26

Who is responsible for providing risk oversight?

Answer 26

The board provides risk oversight of ERM culture, capabilities and practices. A committee can be formed for this purpose (i.e. audit committee, risk committee, executive compensation committee, nomination or governance committee). An audit committee is usually required by regulators.

Question 27

Who has the overall responsibility for ERM?

Answer 27

Management is responsible for the day-to-day managing of risk, including developing and implementing of the COSO ERM framework. Within management, the CEO has ultimate responsibility for ERM and achievement of strategy and business objectives.

Question 28

What role does a risk officer play?

Answer 28

It’s the centralized coordinating point to facilitate risk management across the entire enterprise.

Question 29

What are the three lines of management accountability and their duties?

Answer 29

1. Principal owners of risk: manage performance and risks taken to achieve strategy and objectives.
2. Supporting functions (risk officer): provide guidance on performance and ERM requirements; evaluate adherence to standards; challenge the first line to take prudent risks.
3. Assurance (internal audit): review ERM; identify issues and improvements; inform the board and executives of matters needing resolution.

Question 30

What are the five interrelated ERM components?

Answer 30

1. Governance and culture
2. Strategy and objective setting
3. Performance
4. Review and revision
5. Information, communication and reporting

Question 31

What is the flow chart for ERM?

Answer 31

Mission, Vision & Core Values -> Strategy Development -> Business Objective Formulation -> Implementation & Performance -> Enhanced Value

Question 32

What are the five principles in Governance and Culture?

Answer 32

1. The board exercises risk oversight
2. The organization establishes operating structures
3. The board and management define the desired culture
4. The organization demonstrates commitment to core values
5. The organization attracts, develops and retains capable individuals

Question 33

What are the four principles in Strategy and Business Objectives Setting?

Answer 33

1. The organization analyzes business context and its effect on the risk profile
2. The organization defines risk appetite
3. The organization evaluates alternative strategies and their effects on the risk profile
4. The organization establishes business objectives that align with and support strategy

Question 34

What are the five principles in Performance?

Answer 34

1. The organization identifies risks that affect the performance and business objectives
2. The organization assesses the severity of risk
3. The organization prioritizes risks
4. The organization selects risk responses
5. The organization develops and evaluates its portfolio view of risk

Question 35

What are the three principles in Review and Revision?

Answer 35

1. The organization identifies and assesses changes that may substantially affect strategy and business objectives
2. The organization reviews entity performance results considers risk
3. The organization pursues improvement of ERM

Question 36

What are the three principles in Information, Communication and Reporting?

Answer 36

1. The organization leverages its information system to support ERM
2. The organization uses communication channels to support ERM
3. The organization reports on risk, culture and performance at multiple levels and across the entity

Question 37

How is ERM assessed?

Answer 37

When the components, principles and supporting controls are present (exist) and functioning (continue to operate), ERM is reasonably expected to manage risks effectively and to help create, preserve and realize value.

Question 38

What are the limitations of ERM?

Answer 38

1. Faulty human judgment
2. Cost-benefit considerations
3. Simple mistakes or errors
4. Collusion
5. Management override of ERM practices

Question 39

List the board’s role in risk oversight (including but not limited to).

Answer 39

Review and challenge decisions related to strategy, risk appetite, and major business decisions (i.e. M&A).
Approve management compensation.
Participate in shareholder relations.

Question 40

What are required of the board to be most efficient in risk oversight?

Answer 40

1. Has the skill, experience and business knowledge to understand the organization’s strategy & the industry and to maintain this understanding as business context changes
2. Is INDEPENDENT of the organization
3. Understands the organizational biases influencing decision making and challenges management to minimize them

Question 41

List internal factors that shape culture.

Answer 41

1. Level of judgment and autonomy allowed to personnel
2. Standards and rules
3. Reward system in place

Question 42

List external factors that shape culture.

Answer 42

1. Legal requirements

2. Expectations of stakeholders (customers and investors)

Question 43

What is culture spectrum?

Answer 43

It’s a scale that ranges from risk averse to risk neutral and to risk aggressive. Placement on the scale is determined by the organization’s definition of culture.

Question 44

What is a contingency plan?

Answer 44

It is developed to prepare for succession and critical for ERM. The plan is to train selected personnel to assume responsibilities.

Question 45

What are the factors related to the internal environment of business context?

Answer 45

1. Capital (assets)
2. People (skills and attitudes)
3. Processes (policies, procedures and tasks)
4. Technology

Question 46

What are the factors related to the external environment of business context?

Answer 46

“PESTLE” Analysis:

1. Political (government intervention & influence)
2. Economic (interest rate & availability of credit)
3. Social (consumer preference, demographics)
4. Technological (R&D)
5. Legal (law, regulations and industry standards)
6. Environmental (climate change)

Question 47

What are the characteristics of business context?

Answer 47

Dynamic (new, emerging and changing risks can appear at any time)
Complex (interdependencies and interconnections)
Unpredictable (change can occur in unanticipated ways and rapidly)

Question 48

List methods/approaches for risk identification.

Answer 48

1. Day-to-day activities
2. Simple questionnaires
3. Facilitated workshops
4. Interviews
5. Data tracking

Question 49

How to measure severity of risk?

Answer 49

Measurement can be a combination of impact (positive or negative effect) and likelihood (possibility of event occurrence).

Question 50

What’s the rule of time horizon in assessing risk?

Answer 50

The time horizon to assess risk should be identical to that of the related strategy and business objectives. For example, The risk affecting a strategy that takes two years to achieve should be assess over the same period.

Question 51

What methods are more efficient and less costly for assessing risk?

Answer 51

Qualitative methods; such as interviews, surveys and benchmarking.

Question 52

What methods are more precise for assessing risk?

Answer 52

Quantitative methods; such as decision trees, modeling and Monte Carlo simulation.

Question 53

When to reassess severity?

Answer 53

An organization should reassess severity when a triggering event occurs (i.e. when business context or risk appetite changes)

Question 54

What are the agreed-upon criteria used to evaluate characteristics risk?

Answer 54

Complexity: nature and scope of the risk
Velocity: the speed at which risk affects the entity
Persistence: low long a risk affects the entity, including the time that takes the entity to recover
Adaptability: the entity’s capacity to adjust and respond to risk
Recover: the entity’s capacity (not the time) to return to tolerance

Question 55

What are the four risk views?

Answer 55

1. Risk view (minimal integration): risks identified and assessed so the emphasis is only on the event
2. Risk category view (limited integration): identified and assessed risks are categorized based on operating structures
3. Risk profile view (partial integration): risks are linked to the business objectives that they affect; dependencies between objectives are identified and assessed
4. Risk portfolio view (fully integrated): composite view of risks relates to entity-wide strategy and business objectives and their effects on entity performance

Question 56

How to use a risk portfolio view to ensure risk management?

Answer 56

Management can determine whether the entity’s residual risk profile (inclusive of risk responses) aligns with overall risk appetite.

Question 57

What are the changes that will most likely affect strategy and business objectives substantially?

Answer 57

Business context and culture.

Question 58

True or False. The organization must continually improve ERM at all levels, even if actual performance aligns with target tolerance.

Answer 58

True.

Question 59

What is an open communication channel?

Answer 59

It allows risk information to be sent and received both ways.

Question 60

What are the purposes of reporting in ERM?

Answer 60

It is to support personnel in their understanding of the relationships among risk, culture and performance. It also support their decision making related setting strategy & objectives, governance and day-to-day operations. The reporting can combine quantitative and quantitative risk information, and the emphasis is on information that supports forward-looking decisions.