Systems of RM and IC Flashcards
How does the International Standard ISO31000 define risk?
What does risk refer to?
What is downside risk?
What is upside risk?
= the effective of uncertainty on objectives, whether positive or negative.
Risk refers to the possibility that something unexpected or not planned for will happen.
Downside risk = risk that actual events will turn out worse than expected e.g. fires, IT breakdowns
Upside or opportunity risk = risk that actual events will turn out better than expected e.g. Sales volumes being higher than expected
Which principle and 2 provisions in the UK CG Code relate the board’s responsibilities for internal control, risk management systems and internal audit?
Principle O = board should establish procedures:
1. to manage risk
2. oversee the internal control framework
3. determine the nature and extent of the principal risks it is willing to take
Provision 28 = Board should:
1. carry out a robust assessment of the company’s emerging and principal risks
2. confirm in the annual report that it has completed this assessment
Provision 29 = board should:
1. monitor the company’s risk management and internal control systems
2. at least annually, carry out a review of their effectiveness and report on it
What is business risk?
What is it influenced by? (3)
What are the 4 categories?
= the possibility a company will have lower than anticipated profits or experience a loss rather than taking a profit
- influenced by numerous factors e.g. sales volume, input costs, competition etc.
- Reputational risk = the risk of loss in customer loyalty or support due to an event that has damaged the company’s reputation
- Competition risk = the risk that business performance will be affected because of the actions of the company’s competitors
- Business environment risks = the risk that the business environment in which the company operates will change significantly e.g. political, economic, regulatory, social and environmental factors
- Liquidity risk = the risk that the company will have insufficient cash to settle all of its liabilities on time, so will be forced out of business
What is governance risk? (4)
= relates to risks associated with:
1. Structure = from boards to business models and policy frameworks.
- Processes = from communication channels to strategic planning and risk appetite
- Information = from financial reporting to risk and management reporting
- People and culture = from leadership at the top to accountability and transparency throughout the organisation
What are the 3 main types of internal controls?
What are internal controls and the internal control system aimed at providing? (3)
What are internal control risks?
- Preventative controls intended to prevent an adverse risk event from occurring, e.g. fraud by employees.
- Detective controls for detecting risk events when they occur, so that the appropriate person is alerted, and corrective action taken.
- Corrective controls for dealing with risk events that have occurred and their consequences
Aimed at providing ‘reasonable assurance’ regarding the achievement of objectives in:
1. Effectiveness of operations
2. Reliability of financial reporting
3. Compliance with applicable laws and regulations
- = risks that internal controls will fail to achieve their intended purpose, and will fail to prevent, detect, or correct adverse risk events
What are the 2 most commonly used ‘models’ for risk management and internal control systems?
What has the Turnball guidance now been replaced by?
How are the 2 model different?
Turnbull Report for UK and Committee of Sponsoring Organisations (COSO) for USA.
- replaced by the FRC’s Guidance on Risk Management, Internal Control and Related Financial and Business Reporting (2014)
FRC guidance on risk follows a similar ‘model’ to COSO, however it considers risk management and internal control systems jointly and not as 2 separate systems
What are the 6 steps in developing a risk management system?
- Categorising
- Identifying
- Assessment
- Response
- Monitoring
- Reporting
CATEGORISING RISKS
What are the 4 main risk categories?
What are 3 examples of financial risks?
What are operational risks?
What are compliance risks?
What are 3 strategic risks?
Financial, operational, compliance, and strategic
Financial = internal risks:
1. failure to protect cash
2. Liquidity risk – the lack of cash in the business so it is unable to settle its liabilities on time.
3. Credit risk – customers failing to pay what they owe on time.
Operational = risks of organisational processes and systems failing e.g. a terrorist act;
Compliance = risk that important laws or regulations will not be complied with properly leading to legal action and/or fines
- Strategic = external risks occurring in the business environment, such as
1. people risks;
2. ethical risks;
3. reputational risks
IDENTIFYING RISKS
What are the 4 methods for identifying risks?
- Mind mapping = involves thinking of all the risks to the organisation.
- Process mapping = involves mapping every process within an organisation to identify interdependent, critical and vulnerable functions and activities within the organisation.
- Stress testing = organisations assess their ability to withstand extreme ‘shocks’ or unexpected events in the business environment they operate.
- Use of internally generated documents = typically business impact studies and market research reports
ASSESSING RISKS
Once a risk has been identified, how should it be assessed to see if it qualifies as a principle risk? (2)
What is risk appetite?
What is risk tolerance and how is it measured?
How should risks be ranked so they can be prioritised? (2)
- A procedure should be established to assess:
a. the likelihood or probability of the occurrence; and
b. the potential size of the impact of the occurrence. - criteria should be developed to assess likelihood as high, medium or low and impact as significant, moderate or minor
- Risk appetite = the level of risk that an organisation is willing to take in the pursuit of its objectives = set by the board
- Risk tolerance = the amount of risk that an organisation is prepared to accept in order to achieve its financial objectives = quantitative measure e.g. value at risk (VaR)
- By plotting the assessed risks on a matrix.
2.By multiplying the likelihood ratings against the impact ratings.
RESPONDING TO RISKS
What are the 4 main responses to risk?
- Avoidance = responses which reduce the likelihood of the risk occurring.
○ organisation shuts down or sells that part of the business that is causing the risk. - Reduction = responses that reduce the negative impact or take advantage of opportunities for positive impact.
- Transfer = responses that transfer the risk somewhere else, e.g. insurance or outsourcing.
- Acceptance = responses that retain the risk because it is deemed to be not a significant threat or the organisation has no control over it, e.g. regulatory risk
MONITORING RISKS
What are the 3 most used methods for monitoring risk?
- Stress testing – the organisation assesses the robustness of the risk response by modelling extreme situations
- Developing measures to monitor the effectiveness of the risk response.
- Use of internal audit function
REPORTING RISKS
What are the 2 main communication channels in relation to risk reporting?
How might this be reported in each channel?
- management to board
- board to shareholders
Management to board = Management may use a risk register or dashboard to report to the board on the principal risks faced, the actions taken to deal with the risks, and the effectiveness of those actions
Board to shareholders = company’s strategic report must contain a description of the principal risks and uncertainties facing the company, together with an explanation of how they are to be managed or mitigated
What are 5 benefits of a risk management system?
- Increases the likelihood of achieving business objectives.
- Helps management to enhance risk awareness
- Builds investor confidence
- Shares risk information across the organisation, contributing to informed decisions.
- Facilitates transparency of risks at board level
What is the role of the board in risk management and internal control? (4)
- Deciding the organisation’s risk appetite
- Ensuring that management manage risk within the board’s guidelines for risk appetite
- Monitoring the performance of management
- Monitoring the risk management system to ensure that it is effective and achieves its purpose.
