Evaluating and reporting risk Flashcards

Question

RISK-ASSESSMENT TECHNIQUES - HYBRID - STRESS TESTING What is stress testing? What are 3 common variables? What are the 2 advantages? What is reverse stress testing? What are the 2 approaches to reverse stress testing?

Answer 1

= involves assessing the impact that extreme movements in key financial variables may have on an organisation, either in isolation or together Common variables include: (1) a fall in income (2) rising inflation (3) rising or falling interest rates Advantages: 1. Stress testing is a good way to assess the financial strength of an organisation, especially when faced with extreme events 2. It can help an organisation to prepare for extreme events should they occur, helping to reduce the chance of significant financial distress or bankruptcy Reverse stress test = establishes the point at which an organisation’s objectives are no longer achievable = a useful tool for corporate financial resiliency planning 2 approaches to reverse stress testing: (1) Define a series of events, which will cause the business plan to fail, then measure the implications on the business plan for each of the identified events (2) Start with the income statement and balance sheet and investigate each line item ----> Identify the factors that would affect that line item to such a degree that the business plan fails or the organisation becomes insolvent

Answer 2

= relevant experts and managers determine plausible but extreme future scenarios and then assess the impact on an organisation should the scenario manifest itself 1. Single variable scenarios = focus on specific event or occurrence = looks at both the possible frequency of occurrence and impact from that single event 2. Multi-variable scenarios = examine the occurrence of multiple inter-related events (that may occur at same time or as a chain of linked events) Disadvantages = time consuming and may involve a number of functional specialists and managers Advantages: (1) Can help organisations to anticipate and prepare for extreme scenarios (2) Especially well-suited to testing business continuity plans and for estimating the maximum level of loss = can help determine the level of insurance cover (3) Can determine more accurate probability and impact values for extreme events = allow an organisation to rank scenarios in order of significance = allows scarce management and control resources to be utilised effectively

Answer 3

Risk registers and risk and control self-assessments A spreadsheet or database application used to store information on risk events that have been identified and assessed Important to ensure that data is collected and organised in a way that allows data to be aggregated across different registers (Most organisations have 1 or more risk registers) Updated on a regular basis – typically monthly/quarterly (depends on how often rusk exposure changes) 1. a description of the risk event that has been identified; 2. the risk category that the risk event is linked to; 3. the person responsible for managing the risk event on a day-to-day basis, often known as the risk owner; 4. a qualitative probability and impact assessment of the risk event; and 5. any actions currently under way to control the probability or impact of the risk event.

Answer 4

1. a qualitative probability and impact assessment of inherent risk; 2. a qualitative probability and impact assessment of the residual risk; 3. information on the potential causes of the risk event; 4. information on the potential financial and non-financial impacts of the risk event; 5. Any risk metrics that are used to monitor exposure

Answer 5

= a process that combines risk identification, qualitative risk assessment and an assessment of control effectiveness. Provides a systematic means for identifying control weaknesses and gaps that may threaten the achievement of an organisation’s objectives or the operational efficiency of its systems and processes A key output = the production of action plans that help to allocate scarce resources to address control gaps or weaknesses (where the benefits of doing so exceed the associated costs of increased control) Can be used to support internal audit and governance activities Include the typical components of a risk register, plus an assessment of the effectiveness of the controls that are in place = This assessment is used to estimate the residual risk exposure It is common to link risk events to organisational objectives in a RCSA document = ensures the effect that a risk may have on an organisation’s objectives is understood and supports the board in its governance responsibilities

Answer 6

Effective risk reporting exists to support decision-making in an organisation = decision-makers need information on the nature and extent of risks to make the best possible choices There isn't one, nor is there an optimum number of risks to report = best approach is context-specific and will depend on the nature, scale and complexity of an organisation’s activities and risks RAG = red, amber and green system used to help prioritise risk exposure, control weaknesses, internal audit issues etc. Red = The level of risk exposure is very high (or low) and could threaten the achievement of an organisation’s strategic objectives =Immediate action is required on the part of management to manage the risk in question Amber = The level of risk exposure is higher/lower than normal = Management attention is required to determine whether action needs to be taken in the near future Green = The level of risk exposure is within normal parameters = No action is required – the risk is under adequate control

Answer 7

1. Heat maps 2. Risk event and near miss databases 3. Risk, control and performance indicators 4. Risk dashboards and balanced scorecards 5. Narrative reporting An organisation will select these tools based on regulatory requirements and the needs of their decision-makers Organisations may report the number of risk events or near misses, as well as the value of any financial or non-financial loss If there is sufficient data, it may be possible to provide reports by risk category or business unit and function = can help to focus management attention on key categories of risk or high-risk business units and functions

Answer 8

Use the concept of RAG reporting, but may add black to show extreme risks and blue for insignificant risks (1) some show the status of risk, control, or performance indicators (2) others are used to show trends in risk exposure Large ones can be difficult to interpret, but smaller ones can help management focus on the most significant risk exposures or control weaknesses (red/black or amber) A heat maps which illustrate the level of risk that is currently associated with not meeting each objective

Answer 9

Risk indicators = provide information on an organisation's inherent risk exposure to 1 or more risks E.g., staff turnover, no of attempted IT firewall breaches, credit scores of customers or suppliers that owe money Control indicators = provide information on the effectiveness of controls = help organisations to understand how their residual risk exposures may be changing E.g., frequency of electrical testing, unresolved internal audit issues, number of breaches of policies or procedures Performance indicators = provide information on how effectively an organisation is operating E.g. staff absence rate Different reports may be produced for different departments and functions, as well as different levels of management

Answer 10

= risk reports that combine various risk and control indicators, as well as heat maps, risk event and near miss data May be presented thematically E.g., the board may receive a strategic risk dashboard Senior managers may receive dashboards on topics like health and safety and departments Function managers may receive dashboards relating to their area of responsibility Effective dashboards are not long = care is needed to provide the most relevant sources of information in the clearest way

Answer 11

Used for strategic planning Provide a means of structuring a risk dashboard around an organisation’s objectives so that the risks to these objectives can be monitored and reported Balanced scorecards typically use four focus elements: 1. financial performance 2. operational efficiency 3. human resources 4. compliance Balanced scorecards may be linked to employee development and performance reviews = ensures that an organisation’s employees make risk taking and control decisions that are consistent with its objectives

Answer 12

Involves using words to explain how a risk exposure is changing Common where there is no numerical data that can be reported It may be combined with numerical data to help provide context In a table with columns 'indicator', 'trend' (trend arrows show whether the risk is increasing or decreasing and may be RAG related to provide further context), 'value last month', 'previous value', and 'commentary'

Answer 13

1. Audience 2. Size and level of detail = too much data and audience will have to spend longer reviewing it and less likely to make sense of it Should consult with the indented audience to determine the essential pieces of data and narrative reporting they need in a length and level of complexity that works for them 3. Level of statistical complexity = not all audience's will understand statistics or need a statistically complex report Consultation with the report’s audience should help to determine their requirements 4. Frequency = depends on the frequency with which risk exposures change * In volatile areas like financial markets, reporting may be daily or on a real-time basis * Monthly or quarterly is normal for other risks like health and safety

Answer 14

Because different audiences make different decisions (= require different data) and have different competencies Board = high level risk reports to support governance and strategic decisions = Heat maps and Key Risk Indicator (KRI) reports SM = more detailed reports focusing on key areas of risk to support allocation of resources and escalation, but still high level = Heat maps and KRI reports Business unit = even more detailed reports, but tend to be specific = Review risk registers, KRIs and Key Control Indicators (KCI), loss and near miss data Individual teams and support functions = strong functional and performance focus = Review local risk registers and KRIs/KCIs, local loss and near misses