CHAPTER 5

• Control Activities


  Specific risk management policies and procedures throughout the organization, at all levels and in all functions, to ensure that risk responses are properly executed
• Event Identification


  Component of risk management whereby management identifies potential events, internal or external, that may affect the company's ability to achieve its strategic, operational, reporting, and compliance objectives
• Impact


  Pertains to the magnitude, significance, or consequence of the event or risk to the company
• Internal Environment

  Component of enterprise of risk management that reflects the company's risk management philosophy, risk appetite, board oversight, commitment to ethical values and competence of the human resource, and the assignment of authority and responsibility
• Information and Communication


  Component of enterprise risk management that identifies, captures, and communicates pertinent information from internal and external sources to enable personnel in carrying out their responsibilities
• Inherent Risk


  The susceptibility of the company to risk in the absence of any actions management might take to alter the risk's likelihood or impact. These inherent risks may result from the nature of the company's operation, industry, strategy, environmental, and other factors
• Likelihood


  Pertains to the probability of the occurrence of an event
• Monitoring


  Ongoing activities and separate evaluations that aim to assess both the existence and effective functioning of the risk management components and the quality of their performance over time
• Objective Setting


  Component of enterprise risk management that deals with what the entity seeks to achieve. Objective setting is a prerequisite to the identification and assessment of risks
• Residual Risk


  The risk that remains after applying management's response to the risk
• Risk Assessment


  Evaluation of the identified risks through assessing their likelihood and impact to the company
• Risk Map


  A visual representation of assessed risks whereby significant and insignificant risks are distinguished through color-coding
• Risk Response


  Component of enterprise risk management that deals with what management plans to do with assessed risks. Responses could be to accept, reduce, share, or avoid the risk
• COSO cube


  A diagram on how 2004 COSO-ERM framework is illustrated
• Internal Environment


  • Risk Management Philosophy
  • Risk Appetite
  • Board of Directors
  • Integrity and Ethical Values
  • Commitment to Competence
  • Organizational Structure
  • Assignment of Authority and Responsibility
  • Human Resources Standards
• Objective Setting


  • Strategic Objectives
  • Related Objectives
  • Selected Objectives
  • Risk Appetite
  • Risk Tolerance
• 8 Components of Risk Management

  1. Internal Environment

  2. Objective Setting

  3. Event Identification

  4. Risk Assessment

  5. Risk Response

  6. Control Activities

  7. Information and Communication

  8. Monitoring
• Potentially negative events


  Risks
• Potentially positive events


  Opportunities
• Event Identification


  • Events
  • Influencing Factors
  • Event Identification Techniques
  • Event Interdependencies
  • Event Categories
  • Distinguishing Risks and Opportunities
• Risk Assessment


  • Inherent and residual risk
  • Establishing likelihood and impact
  • Data sources
  • Assessment techniques
  • Event relationships
• Portfolio view of Risks


  Enables management to analyze their (risks) enterprise-wide effects
• Risk Response


  • Evaluating Possible responses
  • Selected responses
  • Portfolio view
• Types of Control Activities

  • Preventive
  • Detective
  • Corrective
• Control Activities


  • Integration with risk response
  • Types of control activities
  • Policies and procedures
  • Controls over info system
  • Entity specific
• Monitoring


  • Ongoing monitoring activities
  • Separate evaluations
  • Reporting deficiencies
• Professional Judgment


  Applied in selecting the appropriate risk rating
• Risks on the bottom left corner of the risk map

  Low Likelihood/Low Impact
• Risks on the top right corner of the risk map

  High Likelihood/High Impact
• Moderate Risks


  High Likelihood/Low Impact and High Impact/Low Likelihood
• 2 ways of monitoring

  • Ongoing monitoring activities (routine mgt reviews)
  • Separate evaluations (internal auditors)