P3 Flashcards
Risk Management Cycle
Establish risk management group & set goals THEN
- identify risk areas
- measure - assess scale of risk
- manage - risk response strategy, implemt strategy & allocate responsibilities, monitor controls
- review & refine process
COSO ERM Framework - 8 components to managing risk (2003 version)
- internal environment
- Objective setting
- Event identification
- Risk assessment
- Risk response
- Control activities
- Information & communication
- Monitoring
COSO 1992 version
- control environment
- Risk assessment
- Control activities
- information & communication
- Monitoring
Risk appetite =
Risk capacity =
Risk attitude =
Residual risk =
Risk appetite = amount willing to accept
Risk capacity = amount can bear
Risk attitude = approach e.g. seeking/averse
Residual risk = risk remaining after controls
VAR =
VAR = Standard deviation x Z score x sq. root no. days
Z scores
95% =
99% =
95% = 1.645
99% =2.33
Economy =
Effectiveness =
Efficiency =
Economy = inputs
Effectiveness = outputs
Efficiency = inputs/outputs relationship
Scenario Planning (7 stages)
- high impact, high uncertainty factors
- identify possible futures
- cluster factors to identify consistent futures
- write scenarios
- identify courses of action
- monitor reality
- revise as needed
5 key principles to UK corporate governance code:
- board leadership & company purpose
- division of responsibilities
- composition, succession & evaluation
- audit, risk & internal control
- remuneration
composition of (no. INEDs)
whole board
nomination committee
remuneration committee
audit committee
whole board = 50% INEDs
nomination committee = 50% INEDs
remuneration committee = 100% INEDs
audit committee = 100% INEDs
A director IS NOT independent if: (6)
- employee in last 5 yrs
- significant shareholder
- close family ties
- receive other pay/benefits
- business relationship
- on board >9yrs
Note: rigorous review after 6 yrs to ensure independence
Control environment =
managements attitudes, actions and awareness of the need for internal controls
COSO 5 integrated elements for effective internal control:
Control environment (tone at the top)
Risk assessment
Control Activities
Information & communication
Monitoring
INTERNAL AUDIT
Required by:
Appointed by:
Reports to:
Reports on:
Opinions on:
Scope of assignment:
test & evaluate controls, special investigations, contribute to risk identification
Required by: management
Appointed by: audit committee
Reports to: audit committee
Reports on: internal controls
Opinions on: adequacy of control
Scope of assignment: prescribed by audit committee
The need for internal audit (3 reasons)
- size e.g. complex activities, no. employees
- Changes e.g. org structure, key risks
- Something has gone wrong
Internal audit attribute standards (3)
Independence (from executive management)
Objectivity
Professional care
Internal audit performance standards (6)
Manage internal audit
Risk management
Control (evaluate & maintain)
Governance (assess)
Internal audit work
Communicate results
3 types of audit risk
Inherent Risk - when no controls in place
Control Risk - controls not sufficient
Detection Risk - Auditors fail to detect
Note: if you can’t control or detect it then it must be inherent!
Types of Malware
Ransomware
Botnets
Spyware
Trojans
Malvertising
Viruses
Ransomware - ‘kidnaps ‘’ data until paid
Botnets - attacker controls infected computers
Spyware - spys on victim & reports back
Trojans - poses as something else
Malvertising - malicious software written into advert
Viruses - replicates & spreads
Application Attacks:
Denial of Service (DoS)
Distributed denial of service (DDoS)
Structured Query Language (SQL)
Cross Site Scripting (XSS)
Man in the middle
Buffer Overflow
Denial of Service (DoS) - overwhelm app to prevent it working
Distributed denial of service (DDoS) - as above on mass
Structured Query Language (SQL) - unprotected input boxes
Cross Site Scripting (XSS) - malicious code from website
Man in the middle - intercepting
Buffer Overflow - attack & data overwritten
3 Cyber security objectives (AIC Triad)
Integrity
Confidentiality
Availability
Penetration Testing Types (4)
simulated phishing
web applications
internal network
Wireless network
NIST Framework Core Activities
Identify, Protect, Detect, Respond, Recover
Digital Resilience: 6 Actions
Identify all issues
Aim to well-defined target
How best to deliver new system
Establish risk/resource trade offs
A plan that aligns to business & tech
Ensure sustained business engagement
COSO (2017 version)
(integrating strategy with performance!)
Governance & culture
strategy & objective setting
performance
review & revision
Info, communication & reporting
Good control environment
no blame culture
Training
encourage reporting
‘tone at the top’
CIMA picks out 5 specific threats to self-interest:
- Holding a financial interest in/receiving a loan from the org
- Participating in incentive compensation arrangements
- Inappropriate use of corporate assets
- Concern over employment security
- Commercial pressure from outside of the org
A fraud response plan should include: (8)
Purpose of the fraud response plan
Corporate policy
Definition of fraud
Roles and responsibilities
The response
The investigation
Organisation’s objectives with respect to fraud
Follow up action
Audit risk affected by…(3 other risk types)
Inherent risk = an amount in the financial statements (for an asset or liability, or a transaction) might be stated as a materially incorrect amount, ignoring the existence of existing internal controls.
Control risk = the existing controls are not sufficient to prevent or detect a material misstatement of a value in the financial statements, use of computerised (or digital) controls may give the auditors more confidence in the controls (or potentially less confidence if the computer system is poor).
Detection risk = the auditors’ substantive tests will not reveal a materially incorrect amount in the financial statements, if such an error exists. The use of technology and algorithms to assist with this has led to concerns over automation bias. Automation bias is where the data used to train the algorithm is flawed and leads the algorithm to be biased.
Audit risk will be affected by changes in any of the three above risks including inherent risk.
