CHAPTER 5

• Risk management process under COSO ERM

  Components: Internal Environment, Objective Setting, Event Identification, Risk Assessment, Risk Response, Control Activities, Information & Communication, Monitoring
• Risk assessment


  • Assessing likelihood and impact of identified risks
  • Evaluating inherent and residual risks
• Risk assessment process


  1. Identify risks

  2. Assess likelihood and impact

  3. Evaluate inherent and residual risks
• Inherent risk


  Susceptibility of the company to risk in the absence of any actions management might take to alter the risk's likelihood or impact
• Residual risk


  Risk that remains after applying management's response to the risk
• Risk response


  1. Evaluate possible responses

  2. Select responses

  3. Maintain portfolio view
• Control activities


  • Preventive, detective, and corrective controls
  • Controls over information systems
• Information and communication


  1. Identify, capture, and communicate pertinent information from internal and external sources

  2. Communicate risk management policies and directives
• Monitoring


  1. Ongoing monitoring activities

  2. Separate evaluations

  3. Report deficiencies
• Each of the eight COSO ERM components must be present and functioning in a company's risk management process, and must operate in an integrated manner to achieve the four business objectives across the enterprise
• Risk rating


  Qualitative (high, moderate, low) or quantitative (0 to 5 score) assessment of likelihood and impact of risks
• Management is most concerned with risks that have "high" likelihood and "high" potential impact
• Professional judgment is often applied in selecting the appropriate risk rating, incorporating other information
• Risk management process


  Components must operate in an integrated manner to achieve business objectives across the enterprise (e.g. entity-level, division, business unit, subsidiary)
• Risk Assessments


  1. Assigning Risk Ratings

  2. Assess likelihood and impact

  3. Assign qualitative risk rating (high, moderate, low)

  4. Assign quantitative risk scores (0 to 5)

  5. Professional judgment applied

  6. Consider historical experience and other information
• Likelihood


  Probability of the occurrence of an event
• Qualitative ratings for likelihood

  • Low
  • Moderate
  • High
• Quantitative ratings for likelihood

  • 1 - Less likely
  • 2 - Likely
  • 3 - Very likely
  • 4 - Virtually certain
• Impact


  Magnitude or consequence of the event or risk to the company
• Qualitative ratings for impact

  • Low - Minor effect
  • Moderate - Medium impact
  • High - Significant impact
• Risk map


  Graphic or visual representation of the likelihood and impact of one or more risks
• Interpretation of risks on a risk map

  • Low likelihood/Low impact - Accept risk
  • High likelihood/High impact - Mitigate, share or avoid
  • High likelihood/Low impact and High impact/Low likelihood - Reduce moderate risks
• Documentation of risk assessment, risk response, and control activities

  Risk assessment template with likelihood, impact, combined score, decision to mitigate/accept, and control activities
• Monitoring and testing of the risk management process

  1. Ongoing monitoring activities

  2. Separate evaluations by internal auditors

  3. Report deficiencies to management and board

  4. Recommendations to improve risk management and control processes
• Inherent risk


  Level of risk before applying management actions
• Residual risk


  Risk that remains after applying management's actions
• Significant risks must be treated differently from risks that are not significant
• If residual risks remain, management should establish and implement additional risk mitigation strategies