Module 3 - Quiz 2 (pt2) Flashcards
Does ERM replace Internal Controls?
No
COSO ERM
Enterprise-wide and brings in the consideration of
external and broader global risks
COSO Internal Controls
More process and internal
focused (e.g., financial reporting)
Both COSO frameworks …
- are distinct and complementary
- have components and principles
Aspects of internal control common to ERM are
- not repeated
- developed further in ERM framework
ERM: Criteria for Assessing ERM Practices
✔ Components & Principles are present and functioning
✔ Components are operating together in an integrated manner
✔ The internal controls necessary to put into effect relevant principles are present and functioning
Principle 1
Board Exercises Risk Oversight
Board has primary responsibility for
risk oversight
(Some Boards retain direct ownership; others delegate to a Board committee )
Management has primary responsibility for
day-to-day risk management
Oversight includes the board interacts how?
- Asking the right questions to challenge management about strategy, business objectives, and performance targets
- Interacting with stakeholders and presenting alternative views / action plans
Oversight requires that the Board understands
- Understands the industry and entity’s strategy
- Is informed on relevant issues
- Remain current as the internal and external environment change
- Ensure that it has appropriate skillsets, expertise, and composition to be effective as the business environment changes
Examples of impaired Board independence
- Financial interest in the entity
- Employee-employer relationship with the entity
- Business relationship with the entity (e.g., supplier, contractor)
How Board should deal with Organizational Bias
Awareness of potential organization biases and challenge management to overcome them
Factors that impact Board’s effectiveness
- Independence
- Suitability of ERM
- Organizational Bias
Suitability of ERM
Determine if the ERM program is appropriately designed to enhance value
Independence (in regard to the Board)
Ability to be objective
(serves as check and balance on management; ensure best interests of stakeholders are served)
Principle 2
Establishes Operating Structures
What is the operating structure?
Defines how the entity organizes and carries out day-to-day operations
- it is aligned with legal structure (how an entity operates) and the management structure (who is responsible for what)
The purpose of Establishing Operating Structures
- To carry out the entity’s strategy and business objectives
- Clearly define authority, reporting lines, roles and responsibilities
- Different operating structures (centralized vs decentralized) may result in different risk profiles
- Management is responsible for developing an entity’s operating structure
(the Board delegates authority to management) - Management regularly evaluates the operating structure in response to changing business context
Principle 3
Defines Desired Culture
Culture directly impacts
- Risk Identification / Assessment process
- Risk Response
- Risk Management
Culture reflects
core values and drives expected day-to-day behaviors and decisions
Who is responsible for defining and creating the desired culture?
Board and the management
Well-defined culture leads to
shared understanding of acceptable risk decisions > risk responses within defined risk appetite > achievement of strategy & business objectives
Culture is influenced by
- Investors expectations
- Reward system
- Level and quality of employee interactions
- Policies
- Regulatory requirements
- Customer expectations
Principle 4
Commitment to Core Values
What are Core Values
communicated from the “top”, are the “tone” of the organization and are reflected in actions and decisions
What is key for Core Values
Consistency is key; not always easy
What does consistency signal
Consistency in the “tone” of the organization signals confidence to stakeholders that entity adheres to its core values
Principle 5
Capable Individuals
Excess pressure will
demotivate employees and could lead to fraud
Capable Individuals
Management, with Board oversight, defines human capital needs necessary to carry out strategy and business objectives
Human Resources function supports management in
- Attract, train, mentor, evaluate & retain employees
- Identify roles critical to the achievement of strategy
- Reward performance
- Tool to enforce desirable behaviors
- Rebalance excess pressures
