Enterprise Risk Management Flashcards
COSO Issued Enterprise Risk Management to
assist companies in developing a Comprehensive response to Risk Management
Strategy of ERM
Balance Risk and Return
Intent of ERM is to allow management to deal with
uncertainty, evaluate risk acceptance and build value (share price appreciation)
ERM Definition
Identify potential events that may effect the entity and manages risk to be within it’s risk appetite to provide reasonable assurance to achieve objectives
ERM themes
Align risk appetite and strategy
Enhance risk response decisions
Reduce operational surprises and losses
Identify and management multiple and cross-enterprise risks
Seize opportunities
Improve deployment of capital
Objectives of ERM
Strategic -goals to achieve company’s mission
Operations
Reporting
Compliance
Components of ERM (IS EAR AIM)
Internal Environment (C) Setting Objectives (SORC) Event Identification (R) Assessment of Risk (R) Risk Response (R) Control Activities (E) Information and Communication (i) Monitoring (M)
Internal Environment (EBOCA + RHR)
Commitment to Ethics and Integrity Board Independence and Oversight Organizational Structure Commitment to Competence Assignment of Authority and Responsibility Risk Management Philosophy Human Resource Standards Risk Appetite
Setting Objectives
Strategic -goals to achieve company’s mission
Operations
Reporting
Compliance
Event Identification -
Events can be
External or Internal
Positive (Opportunities) or Negative (Risks)
External vs Internal examples
External: Economic, Natural Environment, Political, Social, Technological
Internal: Infrastructure, Personnel, Process, Technology
Assessment of Risk
Inherent vs Risidual
Likelihood and Impact
Assessment techniques
Types of assessment techniques
Benchmark (best practices)
Probabilistic (Statistics, range, Data)
Non-probabilistic (Opinions, subjective assumptions) (ex outcome of lawsuit)
Risk Response
Avoid
Reduce
Share
Accept - inherent
Examples of sharing risk reponse
Insurance
Hedging
Outsourcing
Risks should be considered entity wide using
the Portfolio Perspective
Control Activities types
Top Level Reviews (Budget vs Actual)(Variance)
Direct Function or Activity Management (Performance Reports)
Physical Controls (Safeguarding)
Performance indicators (compare financial or operational to determine Red Flags)
Segregration of Duties - Authorizing, Record Keeping, Custodial
Information and Communication
FACT for both internal and external
Fair
Accurate
Complete
Timely
Efficient and Effective operations
ERM must be present and functioning
No Material weaknesses in ERM
Measuring Effectiveness in ERM
Reasonable Assurance
Subject to human judgement (principles based)
Change Management example
Implement new technology and hires someone to help document new policies and procedures and develop training
