Enterprise Risk Management Frameworks

Question 1

The COSO ERM model has 5 components.
The 5 components are:

Answer 1

● Governance and culture
● strategy and Objective-setting
● Performance
● Review and revision
● Ongoing -information, communication, and reporting

Remember GOPRO

Question 2

4 Principles associated with Risk Assessment according to COSO are:

Answer 2

1. Specify objectives
2. Identify and Analyze risks
3. Consider potential for fraud
4. Identify and assess changes

Question 3

The ERM model is geared to achieving 4 main categories of objectives, which are:

Answer 3

● Strategic: high-level goals that align with and support the mission of the entity
● Operations: effective and efficient use of the entity’s resources
● Reporting: reliable reporting
● Compliance: compliance with applicable laws and regulations

Question 4

5 limitations of COSO ERM model are:

Answer 4

● Human judgment and human error
● Cost vs benefits limitations
● Simple errors can lead to big mistakes
● Circumvention of controls or processes due to collusion
● Management override

Question 5

What is the composite view of the risk assumed at a particular level of the entity or aspect of the business that positions mgmt to consider the types, severity an interdependencies of risks and how they affect performance relative to strategy and business objectives.

Answer 5

RISK PROFILE

Question 6

The max amount if risk that an entity is able to absorb in the pursuit of strategy and business objectives is:

Answer 6

Risk capacity

Question 7

The ability of an entity to withstand the impact of large-scale events is:

Answer 7

Organizational Sustainability

Question 8

True or False. Decreasing risk appetite is a component of ERM.

Answer 8

FALSE

Question 9

True or False

Enhancing risk response decisions is a component of ERM.

Answer 9

TRUE. This is a critical component of the ERM framework.

Question 10

What are the 5 principles of Governance:

Answer 10

DESIRED culture
excercizes board OVERSIGHT
demonstrates commitment to core VALUES
attracts capable EMPLOYEES
establishes operating STRUCTURE

HINT: remember DOVES

Question 11

_______________ is responsible for developing and implementing the ERM framework and process.

Answer 11

Management

Question 12

What are the 4 principles of Strategy and objective setting

Answer 12

STRATEGIES
formulated business OBJECTIVES
ANALYZES business context
defines RISK appetite

hint: remember SOAR

Question 13

5 Principles for the performance component of COSO ERM are:

Answer 13

VIEW
ASSESSES severity of risk
PRIORITIZES risk
IDENTIFIES risks
implements risk RESPONSES

hint: remember VAPIR

Question 14

3 Principles of the review and revision component of COSO ERM:

Answer 14

SUBSTANTIAL change
pursues IMPROVEMENT in enterprise risk mgmt
REVIEWS risk and performance

HINT: SIR mnemonic

Question 15

Define “Residual Risk”

Answer 15

The risk that remains after management has taken actions to mitigate negative events.

Question 16

Risk appetite has been exceeded when ___________________________________________?

Answer 16

The combined likelihood and impact of negative events significantly exceed residual risk.

Question 17

What are 4 methods of responding to risks:

Answer 17

• Avoidance - discontinuing or replacing product, service or input in question
• Reduction - could include plant relocation etc.
• Sharing - often associated w/ insurance.. could be through buying purchase options
• Acceptance - doing nothing

Question 18

The risk to an entity in the absence of any direct or focused actions by mgmt. is?

Answer 18

“Inherent Risk”

Question 19

How do you do a cost benefit analysis of risk mitigation using Net Benefit?

Answer 19

To do a cost benefit analysis of risk mitigation costs, you need to find out which method has the greatest Net Benefit.
Formula: Total potential dollar loss x (original risk liklihood % - mitigated risk % liklihood) = benefit. Then benefit - cost of mitigation = NET BENEFIT.
Compare all the methods and pick the one with the HIGHEST NET BENEFIT.

Question 20

The person best suited to devise and execute risk procedures for a particular department as part of the ERM process is ______________________.

Answer 20

The Department Manager