CHAPTER 4

• Risk


  The possibility that an event will occur and adversely affect the achievement of enterprise objectives
• Risk


  • It is inherent in every business
  • No profit will be earned without taking a certain degree of risk
  • Doing business is indeed a risk-taking activity
• Managing risks


  1. Identify risks before they happen

  2. Prepare for risks

  3. Keep risks within manageable levels
• Corporate governance


  Risk management and internal control are central to good corporate governance
• Events affecting the achievement of business objectives

  • Increase in production and operating costs
  • Loss of supply of raw materials needed in production
  • Clerical errors in recording transactions
  • Bankruptcy of a major customer
  • Brownouts, computer breakdown, flood in the office, etc.
• Internal events and their potential impact

  • Internal fraud - Financial loss, Damage to the reputation of the company
  • Machine breakdown - Disruption in the production process, Failure to deliver finished goods to customers
  • Accident in the factory - Physical injuries, loss of lives, Increase in medical costs
  • Violation of laws and regulations - Fines and penalties, Possible criminal prosecution of erring corporate officers and employees
• External events and their potential impact

  • Economic recession - Decline in sales revenue and operating profit, Possible closure of the business
  • Entry of more competitors in the market - Loss of market share, Decline in sales revenue
  • Bankruptcy of a major customer - Failure to collect receivables, Decline in cash balance
  • Pandemic (e.g., COVID-19, SARS) and natural calamities (flood, earthquakes, volcanic eruption) - Disruption in business operations, Decline in revenue and profit, Possibility of closure of the business
• Types of risk


  • Financial risks
  • Nonfinancial risks
• Financial risks


  The likelihood that the company might incur a financial loss, or suffer a decline in profit, capital, investment, or cash flows, on account of the occurrence of events or transactions
• Financial risks


  • Credit risk
  • Liquidity risk
  • Market risks (interest rate risk, foreign currency risk, price risk)
• Credit risk


  The risk that a counter-party such as a customer or a borrower might fail to pay its account on the due date
• Liquidity risk


  The risk that the business will be unable to meet its financial obligations as they fall due because of insufficient cash, inability to liquidate assets, or obtain adequate funding given a short period of time
• Interest rate risk


  The potential decline in earnings and capital arising from changes in interest rates in the market
• Foreign currency risk


  The risk that fluctuations in exchange rates could affect the profit of the business
• Price risk


  The risk that changes in specific prices (stock price, price of other investments) could affect the profit or cash flow of the business
• Business risk


  The possibility that the business may not be able to generate sufficient revenue, or an increase in production and increased operating costs might occur
• Nonfinancial risks


  • Operational risk
  • Legal or compliance risk
  • Health and safety risk
  • Environmental risk
  • Strategic risk
  • Reputation risk
• Operational risk


  The risk that business operations will be disrupted due to inadequate or failed systems, processes, people, breaches in internal controls, or other unforeseen catastrophes
• Legal or compliance risk


  The risk that the company might fail to comply with applicable laws and regulations
• Health and safety risk


  The risk that unforeseen events could result to injuries, illnesses, or even loss of lives
• Environmental risk


  The risk that the company may fail to control or minimize factory wastes, emissions, and other pollutants arising from its business activities
• Strategic risk


  The risk of selecting an inappropriate corporate strategy or the failure of implementing an appropriate one
• Reputation risk


  The risk that the reputation or image of the company will be damaged
• Financial reporting risk


  The possibility that the financial statements of the company will be incorrect due to errors, lapses, or failure to apply accounting standards
• Fraud risk


  The risk arising from deceptive and intentional acts that result to loss of company assets, resources, and reputation
• Enterprise risk management


  A process, effected by an entity's board of directors, management, and other personnel, applied in strategy setting and across the enterprise, designed to identify potential events that may affect the entity, and manage risk to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives
• Roles in the risk management process

  • Board of directors - Conducts an oversight of the effectiveness of the company's risk management process
  • Management - Implements specific risk mitigation and control procedures in managing the various types of risks affecting the company
  • Internal auditors - Conduct evaluation of the risk management process in order to determine its effectiveness over time
• Risk management


  An integrated system of components that operate in an integrated manner in order to address the various risks affecting the company
• Key people in the risk management process

  • Board of directors
  • Management
  • Internal auditors
  • Other personnel
• Board of directors


  Conducts oversight of the effectiveness of the company's risk management process
• Management


  Implements specific risk mitigation and control procedures in managing the various types of risks affecting the company
• Internal auditors


  Conduct examination of the risk management process for the purpose of determining its effectiveness over time
• Other personnel


  Implement specific tasks and duties pertaining to the processes within their departments
• Risk appetite


  The level of risk that the company can accept in pursuit of its objectives
• Risk management process


  1. Setting business objectives

  2. Identifying risks

  3. Assessing risks

  4. Responding to assessed risks

  5. Implementing the risk response

  6. Monitoring the risk management process
• Business objectives


  Strategic, operational, reporting, and compliance
• Strategic objectives are high-level goals aligned with and support the organization's mission and long-term vision
• Operational objectives are goals that are related to the effective and efficient use of corporate resources
• Reporting objectives are goals relating to the reliability and transparency of corporate reports such as financial and nonfinancial reports
• Compliance objectives are goals relating to compliance and conformity with applicable laws and regulatory requirements