CHAPTER 3 Risk and Control Faz

CHAPTER 3
RISK AND CONTROL

Learning Objectives
After going through this chapter, you should be able
to:
 Appreciate the importance of understanding risk and control in an
organisation from the perspectives of the various relevant frameworks.
 Recognize the various risks faced by an organisation.
 Understand internal auditors’ responsibility with respect to risk
management.
 Know the risk management process and, in particular, the Enterprise
Risk Management process.
 Know the different risk management frameworks developed across the
world.
 Learn the basic elements of the COSO control framework.
 Understand internal audit activities with respect to control and risk
management.
 Identify the principles underlying effective internal controls.
2
Definition of Risk Management
Risk management is a process for identifying, assessing, and
prioritising risks of different kinds. Once the risks are identified, the
risk manager will create a plan to minimise or eliminate the impact
of negative events.
 Key responsibility of the management

 Is a proactive and an on-going process involving the identification,
assessment, control, monitoring and reporting of risk-exposures.
 A structured risk management approach also enhances and
encourages the identification of greater opportunities for
continuous improvement through innovation.
 To ensure the successful implementation of risk management,
there must be relevant capabilities in place to manage the
business.
3
3
Organizational Risks
ORGANISATIONAL RISKS
Strategic Operations Reporting Compliance

• Economic • Environmental • Information
• Industry • Legal and
• Financial • Reporting
• Strategic transaction regulatory
• Business
• Social • Control
continuity
• Technological • Professional
• Innovation
• Political • Commercial
• Organizational • Project
systems • Human resource
• Health and
safety
• Property
• Reputational
4
4
Enterprise Risk Management (ERM)
 ERM – is a structured process, effected by an entity’
board of directors, management and other personnel
that is applied in strategy-setting and across the
enterprise. Its goal is to provide reasonable
assurance regarding the achievement of
organisational objectives by identifying events that
may affect the entity and managing risk to be within
the entity’s risk appetite.
 The objective of ERM is to provide the management

and board a commonly accepted model for
assessment and evaluation of an organisation’s risk
management efforts.
5
5
COSO ERM Framework
6
6
COSO ERM Framework
7
7
Risk Assessment
8
Risk Response
9
Role of Internal Auditor
 Test check the adequacy of risk management processes, models
and systems.
 Educate and create awareness among the management and staff
concerning the risk issues.
 Assist the management in developing risk management
framework and its implementation.
 Provide feedback on the appropriateness of risk management
infrastructure.
 Review risk management processes, both their design and how
well they work.
 Review management of those risks classified as ‘key’, including
the effectiveness of the controls and other responses to them.
 Ensure reliable and appropriate assessment of risks and reporting
of risk and control status.
10
10
However, auditor should NOT involve in:
 Setting the risk appetite
 Imposing risk management processes
 Managing assurance on risks
 Taking decisions on risk responses
 Implementing risk responses on management‘s behalf
 Being accountable for risk management
11
11
Responsibility of Board and Management
• Board
• Knowing the extent to which management has established effective
ERM in an organisation.
• Being aware of the organisation’s risk appetite.
• Reviewing the organisation’s risk portfolio to match its risk appetite.
• Being apprised of the most significant risk and management’s response
to the risk.
• Management/Risk Officers
• Ensure that activities conducted are within the organisation’s risk
appetite through proper risk management procedures
• Provide necessary information to risk officers to enable them to
effectively identify and assess the significant risks faced by the
organisation.
• Establish risk management policies
• Frame authority and accountability for managing risk
• Promote competency in risk management
12
Other Risk Management Framework
• Risk Management Standards AS/NZS 4360:2004
13
Other Risk Management Framework
• ISO 31000:2009 Risk Management
14
Internal Control
• COSO’s definition of internal control –
A process, effected by an entity’s board of directors,
management and other personnel, designed to provide
reasonable assurance regarding the achievement of
objectives in the following categories:
• Effectiveness and efficiency of operations
• Reliability of financial reporting
• Compliance with applicable laws and regulations
15
COSO Internal Control Framework
16
16
Components of Internal Control
17
Components of Internal Control (cont.)
Control Environment
• Set the tone of organization and influence the control consciousness of its
people.
• Foundation of all components of internal control, provide discipline &
structure.
Risk Assessment
• Identification and analyze of relevant risk to achieve the objective, & how to
manage other risks.
Control Activities
• Include arrange of activities as diverse as approval authorization, verification,
review of operating performance, security of asset and segregation of duties.
Information & Communication
• Information must be identified, capture and communicated in a form & time
frame that enable to carry out their responsibilities.
Monitoring Activities
• Internal control system need to be monitored- a process that access the
18 quality of the systems performance over time.
Types of Control Activities
Preventive controls: proactive controls that deter undesirable events
from occurring. An example of preventive control is an alarm system.
Detective controls: reactive controls that detect undesirable events

that have occurred. An example of a detective control is the use of
smoke detectors in a building.
Directive controls: proactive controls that encourage a desirable event

to occur. Examples of directive controls are training, guidelines and
incentives.
Mitigating controls: reactive controls that reduce any potential

negative impact if an undesirable event occurs. An example of
mitigating control is insurance.
Compensating controls: controls that work as an additional control

mechanism should an expected control fail. An example of a
19 compensating control is a supervisory review.
Roles of Internal Auditors for Internal Control
 Assess on the effectiveness of the organization’s
system of internal control, including on the adequacy of
control model or design
 Monitor management’s compliance with the
organization’s code of conduct and ethical policies
 Reviewing corporate policies relating to compliance
with laws and regulations, conflict of interests, etc.
 Analyze on the controls for critical functions
 Ensure that:
 Financial and operational information are reliable and possess
integrity
 Operations are performed efficiently and achieve effective
results
 Assets are safeguarded
 Actions and decisions of the organization are in compliance with
20 laws, regulations and contracts
20
Limitations of Controls
 Judgment errors
 Management override
 External events such as flood or land slides
 Excessive or redundant controls
 Overreliance on controls
 Obsolete controls that are caused by changes in the
business process
 Negative attitudes on the controls by employees
21
END CHAPTER 3

CHAPTER 3 Risk and Control Faz

Uploaded by

Copyright:

Available Formats

CHAPTER 3 Risk and Control Faz

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CHAPTER 3 Risk and Control Faz

Uploaded by

Copyright:

Available Formats

CHAPTER 3

RISK AND CONTROL

 Key responsibility of the management

Strategic Operations Reporting Compliance

 The objective of ERM is to provide the management

Detective controls: reactive controls that detect undesirable events

Directive controls: proactive controls that encourage a desirable event

Mitigating controls: reactive controls that reduce any potential

Compensating controls: controls that work as an additional control

You might also like