Units 1 & 2 Flashcards
How does ISO31000 define a risk?
The effect of uncertainty on objectives.
What do we mean by the ‘effect ‘ of a risk?
Deviation from the expected.
How does ISO31000 define traditional risk management?
Coordinated activities to direct and control an organization with regard to risk.
How does ERM differ to traditional risk management?
- led from the top-down
- reducing silos
- having a holistic risk profile
- identifying critical risks & responsibilities
- finding interdependencies
What’s the general timeline of the history of risk management?
- in the middle ages people were superstitious and believed risk events were an ‘act of god’
-then story telling began to show the first records of cause and event
-700-800 years ago the Hindu-Arabic numbering system reached Europe and allow for the beginnings of mathematical probability
-in the 17th century the probability theory was introduced (principally designed for gambling) - then modern beauratic states formed and began collecting vast data sets
-banks and insurance companies started using specific, quantitative forms of RM - in 1995-2004 the first risk management standards were introduced e.g. COSO ERM Cube
- and between 2004-2018 the RM focus has shifted to include ESG
When did risk management first become recognized as a formal profession?
1970s- mainly in finance and insurance sectors
How do the IRM describe the objectives of ERM?
MADE2
-mandatory
-assurance
-decision-making
-efficient and effective processes
How doo the IRM describe the benefits of ERM?
STOC
-Strategy
-Tactics
-Operations
-Compliance
How does ERM relate to organizational strategy?
- understanding overall risk exposure
- comparing overall risk exposure to risk appetite
- ensuring a balance between the cost/benefit of controls
- supporting a return on investment
How does ERM relate to Governance?
- creating accountability
-ensuring the prioritization of limited resources - enhancing the efficiency of reporting and decision-making
- embedding a risk-aware culture
How does ERM relate to Resilience?
- preparing for changes in the context
- avoiding negative surprises
- supporting quick/agile responses
- coping with crises
How do SATALA (consultants) describe the steps of the RM process?
- Define the context and objectives
- Assess the risk
- Manage the risk
- Monitor, review and report the risk
What do SATARLA say are the two choices we can make when understanding if it’s possible to achieve an objective?
- direct more resource towards the management of the associated risk/s
- OR rescope the objective so that it’s more realistic
How does the Orange Book describe ERM integration?
ERM should be used to assess costs & benefits and inform decision-making by exploring alternative ways to meet objectives.
What is a RM standard?
Standards set out the overall RM approach, including a description of the process along with the framework that supports the integration of that process.
What is a RM framework?
Frameworks define the risk management context, including the architecture, strategy and protocols (RASP)
What is a RM process?
Processes describe the steps in how you manage risks.
What’s the latest date of ISO31000?
2018
What’s included in the ISO31000 standard?
- 8 principles
- 6 framework stages
- 6 process steps
What are the 8 ISO31000 principles?
Integrated, structured and comprehensive, customized, inclusive, dynamic, best available information, human and cultural factors & continual improvement.
What are the 6 ISO31000 framework stages?
Leadership and commitment, integration, design, implementation. evaluation, improvement.
What are the 6 ISO31000 process steps?
Communication & consultation, scope context and criteria, risk assessment (identification, analysis and evaluation), risk treatment, risk monitoring and review and risk recording and reporting.
What’s included on the different faces of the COSO 2004 ERM Cube?
8 x principles (front face)
Business areas (right face)
4x objectives (top face)
What are the 5 components of the COSO 2017 Rainbow-Double Helix?
- Governance and culture
- Strategy and objectives
- Performance
- Review and revision
- Information and reporting
What are the main things to remember about Sarbanes-Oxley?
- written in 2002
- applicable to the United States
- highlighted in the financial crisis of 2008
- requires accuracy of financial reporting
- supports the COSO approach
What are the main things to remember about the Orange Book?
- updated in 2023
- applicable to UK Government organizations
- has five principles (governance and leadership, integration, collaboration & best information, process, continual improvement)
How does the IRM summarize the attributes of effective ERM?
PACED. Proportionate, Aligned, Comprehensive, Embedded, Dynamic.
RASP. What’s included in the risk architecture?
- expected flow of information
- roles and responsibilities
- terms of reference
- committee structures
RASP. What does RACI stand for?
Responsible, accountable, consulted, informed.
RASP. What’s the role of the director?
- to promote organizational success
- to delegate to a CRO (where appropriate)
- to ensure divisions are bought together (breaking silos)
- to ensure risk information is monitored and used to make improvements.
RASP. What’s the role of a risk manager?
- take responsibility for implementation of the risk framework (RASP)
- share corporate learning and ERM benefits
RASP. What’s the role of a local manager?
- identify and assess business unit risks
- escalate through the central risk function (ensuring oversight and establishment of priorities)
RASP. What’s the role of the Board?
- overall responsibility for the organization’s risks
- form and monitor performance of the strategy
- determine risk appetite
- monitor control effectiveness
RASP. What’s the role of the audit committee?
- evaluate RM processes
RASP. What IS NOT the role of the audit committee?
- implement RM responses
RASP. What’s included in the risk strategy?
- sets the tone-from-the -top
- includes the philosophy, attitudes and appetite to risk taking
- explains what the organization wants to achieve in terms of STOC
- is outlined in the policy
RASP. What’s included in the risk policy?
- the strategy
- commitment from the Board
- roles and responsibilities
-provision of resources
RASP. What’s the definition of risk appetite?
The amount of risk an organization is willing to seek or accept in pursuit of long-term objectives.
RASP. What’s the definition of risk capacity?
The maximum amount of risk an organization can afford.
RASP. What does an organization’s capacity depend on?
Their capabilities.
RASP. What’s included in the risk protocols?
HOW we implement risk management, including common terminology, steps, tools and techniques.
