Reporting on Risk Management

Question 1

Why might an organisation have multiple reporting requirements?

Answer 1

Listed on more than one stock exchange

charitable subsidiaries

subsidiaries that operate as insurance companies

Question 2

Why might an org opt to report on RM?

Answer 2

To achieve higher profile e.g. corporate social responsibility

Question 3

What reporting requirements are companies listed on the US stock exchange subjected to?

Answer 3

Sarbanes-Oxley Act 2002:

• IA certified risk assessment of org’s financial structure
• Approved RM framework - most commonly COSO
• Risk reports (Form 20F and 10K) describing future risk (typically 3-10 pages)
• Factors that could cause future financial difficulties listed and then described in more detail (typically half a page)

Question 4

Why has Sarbanes-Oxley Act been criticised?

Answer 4

Large amount of onerous, costly work involved in compliance

Strengthens public and shareholder trust but doesn’t necessarily improve ethical standards.

Seen as reactionary in response to ethical failures of a handful of execs

Question 5

UK Charity Commission states that risk reporting should reflect the size and complexity of the org. Reports should be in narrative format and should include…?

Answer 5

• acknowledgement of trustees responsibilities
• overview of the risk identification process
• indication that major risks have been reviewed or assessed
• confirmation that control systems have been established

Question 6

As a matter of best practice what might larger or more complex charities report in addition to the basic requirements?

Answer 6

• linkage between strategic objectives and major risk identification
• procedures that go beyond financial RM e.g. operations and compliance
• linkage between risk assessment/evaluation and likelihood/impact
• how risk assessment activities are monitored and embedded
• trustees review of principle risks identified

Question 7

To what degree is RM seen as important by charities?

Answer 7

Seen as increasingly important, with some charities spending more on RM than fundraising.

Question 8

Is public sector risk reporting mandatory?

Answer 8

Yes

Question 9

What are the UK Government Principles of risk reporting?

Answer 9

• Openness and transparency about the risks to the public and process for managing them
• Involvement of those concerned in the decision making process
• Proportionate and consistent response to risks to the public
• Evidence-based decision-making
• Responsibility allocated to those best placed to control risks

Question 10

The Governments focus on sources of risk rather than objectives or dependencies is indicative of the importance placed on risk management. What sort of sources will a government agency or department be considering?

Answer 10

Political
Climate
Energy competition
Poverty/inequality
Globalisation

Question 11

To what degree do governments share security threats?

Answer 11

Increasingly more so:

• National Security Strategy of the UK
• Cabinet Office National Risk Register