ApplyingCOSO’s

EnterpriseRiskManagement—IntegratedFrameworkSeptember29,2004Today’sorganizationsareconcernedabout:RiskManagementGovernanceControlAssurance(andConsulting)ERMDefined:“…aprocess,effectedbyanentity'sboardofdirectors,managementandotherpersonnel,appliedinstrategysettingandacrosstheenterprise,designedtoidentifypotentialeventsthatmayaffecttheentity,andmanageriskstobewithinitsriskappetite,toprovidereasonableassuranceregardingtheachievementofentityobjectives.”Source:COSOEnterpriseRiskManagement–IntegratedFramework.2004.COSO.WhyERMIsImportantUnderlyingprinciples:

Everyentity,whetherfor-profit

ornot,existstorealizevaluefor

itsstakeholders.Valueiscreated,preserved,orerodedbymanagementdecisionsinallactivities,fromsettingstrategytooperatingtheenterpriseday-to-day.WhyERMIsImportantERMsupportsvaluecreationbyenablingmanagementto:

Dealeffectivelywithpotentialfutureeventsthatcreateuncertainty.Respondinamannerthatreducesthelikelihoodofdownsideoutcomesandincreasestheupside.

ThisCOSOERMframeworkdefinesessentialcomponents,suggestsacommonlanguage,andprovidescleardirectionandguidanceforenterpriseriskmanagement.EnterpriseRiskManagement—IntegratedFrameworkTheERMFrameworkEntityobjectivescanbeviewedinthecontextoffourcategories:

StrategicOperationsReportingComplianceTheERMFrameworkERMconsidersactivitiesatalllevelsoftheorganization:Enterprise-levelDivisionor subsidiaryBusinessunit processesEnterpriseriskmanagement

requiresanentitytotakeaportfolioviewofrisk.

TheERMFrameworkManagementconsidershow

individualrisksinterrelate.Managementdevelopsaportfolioviewfromtwoperspectives:-Businessunitlevel-EntitylevelTheERMFrameworkTheeightcomponentsoftheframeworkareinterrelated…TheERMFrameworkInternalEnvironmentEstablishesaphilosophyregardingriskmanagement.Itrecognizesthatunexpectedaswellasexpectedeventsmayoccur.Establishestheentity’sriskculture.Considersallotheraspectsofhowtheorganization’sactionsmayaffectitsriskculture.ObjectiveSettingIsappliedwhenmanagementconsidersrisksstrategyinthesettingofobjectives.Formstheriskappetiteoftheentity—ahigh-levelviewofhowmuchriskmanagementandtheboardarewillingtoaccept.Risktolerance,theacceptablelevelofvariationaroundobjectives,isalignedwithriskappetite.EventIdentificationDifferentiatesrisksandopportunities.Eventsthatmayhaveanegativeimpactrepresentrisks.Eventsthatmayhaveapositiveimpactrepresentnaturaloffsets(opportunities),whichmanagementchannelsbacktostrategysetting.EventIdentificationInvolvesidentifyingthoseincidents,occurringinternallyorexternally,thatcouldaffectstrategyandachievementofobjectives.Addresseshowinternalandexternalfactorscombineandinteracttoinfluencetheriskprofile.RiskAssessmentAllowsanentitytounderstandtheextenttowhichpotentialeventsmightimpactobjectives.Assessesrisksfromtwoperspectives:-Likelihood-ImpactIsusedtoassessrisksandisnormallyalsousedtomeasuretherelatedobjectives.RiskAssessmentEmploysacombinationofbothqualitativeandquantitativeriskassessmentmethodologies.Relatestimehorizonstoobjectivehorizons.Assessesriskonbothaninherentandaresidualbasis.RiskResponseIdentifiesandevaluatespossibleresponsestorisk.Evaluatesoptionsinrelationtoentity’’sriskappetite,costvs.benefitofpotentialriskresponses,anddegreetowhicharesponsewillreduceimpactand/orlikelihood.Selectsandexecutesresponsebasedonevaluationoftheportfolioofrisksandresponses.ControlActivitiesPoliciesandproceduresthathelpensurethattheriskresponses,aswellasotherentitydirectives,arecarriedout.Occurthroughouttheorganization,atalllevelsandinallfunctions.Includeapplicationandgeneralinformationtechnologycontrols.Managementidentifies,captures,andcommunicatespertinentinformationinaformandtimeframethatenablespeopletocarryouttheirresponsibilities.Communicationoccursinabroadersense,flowingdown,across,anduptheorganization.Information&CommunicationMonitoringEffectivenessoftheotherERMcomponentsismonitoredthrough:Ongoingmonitoringactivities.Separateevaluations.Acombinationofthetwo.InternalControlAstrongsystemofinternalcontrolisessentialtoeffectiveenterpriseriskmanagement.ExpandsandelaboratesonelementsofinternalcontrolassetoutinCOSO’s

“controlframework.””Includesobjectivesettingasaseparatecomponent.Objectivesarea““prerequisite”forinternalcontrol.Expandsthecontrolframework’s“FinancialReporting”and““RiskAssessment.””RelationshiptoInternalControl—IntegratedFrameworkERMRoles&ResponsibilitiesManagementTheboardofdirectorsRiskofficersInternalauditorsInternalAuditorsPlayanimportantroleinmonitoringERM,butdoNOThaveprimaryresponsibilityforitsimplementationormaintenance.Assistmanagementandtheboardorauditcommitteeintheprocessby:-Monitoring-Evaluating-Examining-Reporting-RecommendingimprovementsVisittheguidancesectionofTheIIA’sWebsiteforTheIIA’spositionpaper,““RoleofInternalAuditing’sinEnterpriseRiskManagement.”InternalAuditors2010.A1–Theinternalauditactivity’’splanofengagementsshouldbebasedonariskassessment,undertakenatleastannually.2120.A1–Basedontheresultsoftheriskassessment,theinternalauditactivityshouldevaluatetheadequacyandeffectivenessofcontrolsencompassingtheorganization’sgovernance,operations,andinformationsystems.2210.A1–Whenplanningtheengagement,theinternalauditorshouldidentifyandassessrisksrelevanttotheactivityunderreview.Theengagementobjectivesshouldreflecttheresultsoftheriskassessment.StandardsOrganizationaldesignofbusinessEstablishinganERMorganizationPerformingriskassessmentsDeterminingoverallriskappetiteIdentifyingriskresponsesCommunicationofriskresultsMonitoringOversight&periodicreviewbymanagementKeyImplementationFactorsOrganizationalDesignStrategiesofthebusinessKeybusinessobjectivesRelatedobjectivesthatcascadedowntheorganizationfromkeybusinessobjectivesAssignmentofresponsibilitiestoorganizationalelementsandleaders(linkage)Example:LinkageMission–Toprovidehigh-qualityaccessibleandaffordablecommunity-basedhealthcareStrategicObjective–Tobethefirstorsecondlargest,full-servicehealthcareproviderinmid-sizemetropolitanmarketsRelatedObjective–Toinitiatedialoguewithleadershipof10topunder-performinghospitalsandnegotiateagreementswithtwothisyearEstablishERMDetermineariskphilosophySurveyriskcultureConsiderorganizationalintegrityandethicalvaluesDeciderolesandresponsibilitiesExample:ERMOrganizationERMDirectorVicePresidentandChiefRiskOfficerCorporateCreditRiskManagerInsuranceRiskManagerERMManagerERMManagerStaffStaffStaffFESCommodityRiskMg.DirectorRiskassessmentistheidentificationandanalysisofriskstotheachievementofbusinessobjectives.Itformsabasisfordetermininghowrisksshouldbemanaged.AssessRiskEnvironmentalRisksCapitalAvailabilityRegulatory,Political,andLegalFinancialMarketsandShareholderRelationsProcessRisksOperationsRiskEmpowermentRiskInformationProcessing/TechnologyRiskIntegrityRiskFinancialRiskInformationforDecisionMakingOperationalRiskFinancialRiskStrategicRiskExample:RiskModelSource:BusinessRiskAssessment.1998––TheInstituteofInternalAuditorsControlItShareorTransferItDiversifyorAvoidItRiskManagementProcessLevelActivityLevelEntityLevelRiskMonitoring

IdentificationMeasurementPrioritizationRiskAssessmentRiskAnalysisDETERMINERISKAPPETITERiskappetiteistheamountofrisk——onabroadlevel—anentityiswillingtoacceptinpursuitofvalue.Usequantitativeorqualitativeterms(e.g.earningsatriskvs.reputationrisk),andconsiderrisktolerance(rangeofacceptablevariation).Keyquestions:Whatriskswilltheorganizationnotaccept?(e.g.environmentalorqualitycompromises)Whatriskswilltheorganizationtakeonnewinitiatives?(e.g.newproductlines)Whatriskswilltheorganizationacceptforcompetingobjectives?(e.g.grossprofitvs.marketshare?)DETERMINERISKAPPETITEQuantificationofriskexposureOptionsavailable:-Accept=monitor-Avoid=eliminate(getoutofsituation)-Reduce=institutecontrols-Share=partnerwithsomeone(e.g.insurance)Residualrisk(unmitigatedrisk–e.g.shrinkage)IDENTIFYRISKRESPONSESImpactvs.ProbabilityControlShareMitigate&ControlAcceptHighRiskMediumRiskMediumRiskLowRiskLowHighHighIMPACTPROBABILITYLowHighHighIMPACTPROBABILITYHighRiskMediumRiskMediumRiskLowRiskExample:CallCenterRiskAssessmentLossofphonesLossofcomputersCreditriskCustomerhasalongwaitCustomercan’’tgetthroughCustomercan’’tgetanswersEntryerrorsEquipmentobsolescenceRepeatcallsforsameproblemFraudLosttransactionsEmployeemoraleControlRiskControlObjectiveActivityCompletenessMaterialAccrualoftransaction openliabilitiesnotrecordedInvoicesaccruedafterclosingIssue:InvoicesgotofieldandAPisnotawareofliability.Example:AccountsPayableProcessDashboardofrisksandrelatedresponses(visualstatusofwherekeyrisksstandrelativetorisktolerances)FlowchartsofprocesseswithkeycontrolsnotedNarrativesofbusinessobjectiveslinkedtooperationalrisksandresponsesListofkeyriskstobemonitoredorusedManagementunderstandingofkeybusinessriskresponsibilityandcommunicationofassignmentsCommunicateResultsMonitorCollectanddisplayinformationPerformanalysis-Risksarebeingproperlyaddressed-ControlsareworkingtomitigaterisksAccountabilityforrisksOwnershipUpdates-Changesinbusinessobjectives-Changesinsystems-ChangesinprocessesManagementOversight&PeriodicReviewInternalauditorscanaddvalueby:Reviewingcriticalcontrolsystemsandriskmanagementprocesses.Performinganeffectivenessreviewofmanagement'sriskassessmentsandtheinternalcontrols.Providingadviceinthedesignandimprovementofcontrolsystemsandriskmitigationstrategies.Implementingarisk-basedapproachtoplanningandexecutingtheinternalauditprocess.Ensuringthatinternalauditing’sresourcesaredirectedatthoseareasmostimportanttotheorganization.Challengingthebasisofmanagement’sriskassessmentsandevaluatingtheadequacyandeffectivenessofrisktreatmentstrategies.Internalauditorscanaddvalueby:FacilitatingERMworkshops.Definingrisktoleranceswherenonehavebeenidentified,basedoninternalauditing'sexperience,judgment,andconsultationwithmanagement.Internalauditorscanaddvalueby:FormoreinformationThispresentationwasproducedbyApplyingCOSO’sEnterpriseRiskManagement—IntegratedFramework9、靜夜四無鄰鄰，荒居舊業(yè)業(yè)貧。。12月-2212月-22Tuesday,December20,202210、雨中黃葉樹樹，燈下白頭頭人。。16:52:4016:52:4016:5212/20/20224:52:40PM11、以我獨(dú)沈沈久，愧君君相見頻。。。12月-2216:52:4016:52Dec-2220-Dec-2212、故故人人江江海海別別，，幾幾度度隔隔山山川川。。。。16:52:4016:52:4016:52Tuesday,December20,202213、乍乍見見翻翻疑疑夢夢，，相相悲悲各各問問年年。。。。12月月-2212月月-2216:52:4016:52:40December20,202214、他鄉(xiāng)生生白發(fā)，，舊國見見青山。。。20十十二月20224:52:40下午午16:52:4012月-2215、比比不不了了得得就就不不比比，，得得不不到到的的就就不不要要。。。。。。十二二月月224:52下下午午12月月-2216:52December20,202216、行行動動出出成成果果，，工工作作出出財財富富。。。。2022/12/2016:52:4116:52:4120December202217、做前，能夠夠環(huán)視四周；；做時，你只只能或者最好好沿著以腳為為起點(diǎn)的射線線向前。。4:52:41下午4:52下下午16:52:4112月-229、沒沒有有失失敗敗，，只只有有暫暫時時停停止止成成功功??！。。12月月-2212月月-22Tuesday,December20,202210、很很多多事事情情努努力力了了未未必必有有結(jié)結(jié)果果，，但但是是不不努努力力卻卻什什么么改改變變也也沒沒有有。。。。16:52:4116:52:4116:5212/20/20224:52:41PM11、成成功功就就是是日日復(fù)復(fù)一一日日那那一一點(diǎn)點(diǎn)點(diǎn)點(diǎn)小小小小努努力力的的積積累累。。。。12月月-2216:52:4116:52Dec-2220-Dec-2212、世世間間成成事事，，不不求求其其絕絕對對圓圓滿滿，，留留一一份份不不足足，，可可得得無無限限完完美美。。。。16:52:4116:52:4116:52Tuesday,December20,202213、不知香香積寺，，數(shù)里入入云峰。。。12月-2212月-2216:52:4116:52:41December20,202214、意