ApplyingCOSO’s

EnterpriseRiskManagement—IntegratedFrameworkSeptember29,2004Today’sorganizationsareconcernedabout:RiskManagementGovernanceControlAssurance(andConsulting)ERMDefined:“…aprocess,effectedbyanentity'sboardofdirectors,managementandotherpersonnel,appliedinstrategysettingandacrosstheenterprise,designedtoidentifypotentialeventsthatmayaffecttheentity,andmanageriskstobewithinitsriskappetite,toprovidereasonableassuranceregardingtheachievementofentityobjectives.”Source:COSOEnterpriseRiskManagement–IntegratedFramework.2004.COSO.WhyERMIsImportantUnderlyingprinciples:

Everyentity,whetherfor-profit

ornot,existstorealizevaluefor

itsstakeholders.Valueiscreated,preserved,orerodedbymanagementdecisionsinallactivities,fromsettingstrategytooperatingtheenterpriseday-to-day.WhyERMIsImportantERMsupportsvaluecreationbyenablingmanagementto:

Dealeffectivelywithpotentialfutureeventsthatcreateuncertainty.Respondinamannerthatreducesthelikelihoodofdownsideoutcomesandincreasestheupside.

ThisCOSOERMframeworkdefinesessentialcomponents,suggestsacommonlanguage,andprovidescleardirectionandguidanceforenterpriseriskmanagement.EnterpriseRiskManagement—IntegratedFrameworkTheERMFrameworkEntityobjectivescanbeviewedinthecontextoffourcategories:

StrategicOperationsReportingComplianceTheERMFrameworkERMconsidersactivitiesatalllevelsoftheorganization:Enterprise-levelDivisionor subsidiaryBusinessunit processesEnterpriseriskmanagement

requiresanentitytotakeaportfolioviewofrisk.

TheERMFrameworkManagementconsidershow

individualrisksinterrelate.Managementdevelopsaportfolioviewfromtwoperspectives:-Businessunitlevel-EntitylevelTheERMFrameworkTheeightcomponentsoftheframeworkareinterrelated…TheERMFrameworkInternalEnvironmentEstablishesaphilosophyregardingriskmanagement.Itrecognizesthatunexpectedaswellasexpectedeventsmayoccur.Establishestheentity’sriskculture.Considersallotheraspectsofhowtheorganization’sactionsmayaffectitsriskculture.ObjectiveSettingIsappliedwhenmanagementconsidersrisksstrategyinthesettingofobjectives.Formstheriskappetiteoftheentity—ahigh-levelviewofhowmuchriskmanagementandtheboardarewillingtoaccept.Risktolerance,theacceptablelevelofvariationaroundobjectives,isalignedwithriskappetite.EventIdentificationDifferentiatesrisksandopportunities.Eventsthatmayhaveanegativeimpactrepresentrisks.Eventsthatmayhaveapositiveimpactrepresentnaturaloffsets(opportunities),whichmanagementchannelsbacktostrategysetting.EventIdentificationInvolvesidentifyingthoseincidents,occurringinternallyorexternally,thatcouldaffectstrategyandachievementofobjectives.Addresseshowinternalandexternalfactorscombineandinteracttoinfluencetheriskprofile.RiskAssessmentAllowsanentitytounderstandtheextenttowhichpotentialeventsmightimpactobjectives.Assessesrisksfromtwoperspectives:-Likelihood-ImpactIsusedtoassessrisksandisnormallyalsousedtomeasuretherelatedobjectives.RiskAssessmentEmploysacombinationofbothqualitativeandquantitativeriskassessmentmethodologies.Relatestimehorizonstoobjectivehorizons.Assessesriskonbothaninherentandaresidualbasis.RiskResponseIdentifiesandevaluatespossibleresponsestorisk.Evaluatesoptionsinrelationtoentity’’sriskappetite,costvs.benefitofpotentialriskresponses,anddegreetowhicharesponsewillreduceimpactand/orlikelihood.Selectsandexecutesresponsebasedonevaluationoftheportfolioofrisksandresponses.ControlActivitiesPoliciesandproceduresthathelpensurethattheriskresponses,aswellasotherentitydirectives,arecarriedout.Occurthroughouttheorganization,atalllevelsandinallfunctions.Includeapplicationandgeneralinformationtechnologycontrols.Managementidentifies,captures,andcommunicatespertinentinformationinaformandtimeframethatenablespeopletocarryouttheirresponsibilities.Communicationoccursinabroadersense,flowingdown,across,anduptheorganization.Information&CommunicationMonitoringEffectivenessoftheotherERMcomponentsismonitoredthrough:Ongoingmonitoringactivities.Separateevaluations.Acombinationofthetwo.InternalControlAstrongsystemofinternalcontrolisessentialtoeffectiveenterpriseriskmanagement.ExpandsandelaboratesonelementsofinternalcontrolassetoutinCOSO’s

“controlframework.””Includesobjectivesettingasaseparatecomponent.Objectivesarea““prerequisite”forinternalcontrol.Expandsthecontrolframework’s“FinancialReporting”and““RiskAssessment.””RelationshiptoInternalControl—IntegratedFrameworkERMRoles&ResponsibilitiesManagementTheboardofdirectorsRiskofficersInternalauditorsInternalAuditorsPlayanimportantroleinmonitoringERM,butdoNOThaveprimaryresponsibilityforitsimplementationormaintenance.Assistmanagementandtheboardorauditcommitteeintheprocessby:-Monitoring-Evaluating-Examining-Reporting-RecommendingimprovementsVisittheguidancesectionofTheIIA’sWebsiteforTheIIA’spositionpaper,““RoleofInternalAuditing’sinEnterpriseRiskManagement.”InternalAuditors2010.A1–Theinternalauditactivity’’splanofengagementsshouldbebasedonariskassessment,undertakenatleastannually.2120.A1–Basedontheresultsoftheriskassessment,theinternalauditactivityshouldevaluatetheadequacyandeffectivenessofcontrolsencompassingtheorganization’sgovernance,operations,andinformationsystems.2210.A1–Whenplanningtheengagement,theinternalauditorshouldidentifyandassessrisksrelevanttotheactivityunderreview.Theengagementobjectivesshouldreflecttheresultsoftheriskassessment.StandardsOrganizationaldesignofbusinessEstablishinganERMorganizationPerformingriskassessmentsDeterminingoverallriskappetiteIdentifyingriskresponsesCommunicationofriskresultsMonitoringOversight&periodicreviewbymanagementKeyImplementationFactorsOrganizationalDesignStrategiesofthebusinessKeybusinessobjectivesRelatedobjectivesthatcascadedowntheorganizationfromkeybusinessobjectivesAssignmentofresponsibilitiestoorganizationalelementsandleaders(linkage)Example:LinkageMission–Toprovidehigh-qualityaccessibleandaffordablecommunity-basedhealthcareStrategicObjective–Tobethefirstorsecondlargest,full-servicehealthcareproviderinmid-sizemetropolitanmarketsRelatedObjective–Toinitiatedialoguewithleadershipof10topunder-performinghospitalsandnegotiateagreementswithtwothisyearEstablishERMDetermineariskphilosophySurveyriskcultureConsiderorganizationalintegrityandethicalvaluesDeciderolesandresponsibilitiesExample:ERMOrganizationERMDirectorVicePresidentandChiefRiskOfficerCorporateCreditRiskManagerInsuranceRiskManagerERMManagerERMManagerStaffStaffStaffFESCommodityRiskMg.DirectorRiskassessmentistheidentificationandanalysisofriskstotheachievementofbusinessobjectives.Itformsabasisfordetermininghowrisksshouldbemanaged.AssessRiskEnvironmentalRisksCapitalAvailabilityRegulatory,Political,andLegalFinancialMarketsandShareholderRelationsProcessRisksOperationsRiskEmpowermentRiskInformationProcessing/TechnologyRiskIntegrityRiskFinancialRiskInformationforDecisionMakingOperationalRiskFinancialRiskStrategicRiskExample:RiskModelSource:BusinessRiskAssessment.1998––TheInstituteofInternalAuditorsControlItShareorTransferItDiversifyorAvoidItRiskManagementProcessLevelActivityLevelEntityLevelRiskMonitoring

IdentificationMeasurementPrioritizationRiskAssessmentRiskAnalysisDETERMINERISKAPPETITERiskappetiteistheamountofrisk——onabroadlevel——anentityiswillingtoacceptinpursuitofvalue.Usequantitativeorqualitativeterms(e.g.earningsatriskvs.reputationrisk),andconsiderrisktolerance(rangeofacceptablevariation).Keyquestions:Whatriskswilltheorganizationnotaccept?(e.g.environmentalorqualitycompromises)Whatriskswilltheorganizationtakeonnewinitiatives?(e.g.newproductlines)Whatriskswilltheorganizationacceptforcompetingobjectives?(e.g.grossprofitvs.marketshare?)DETERMINERISKAPPETITEQuantificationofriskexposureOptionsavailable:-Accept=monitor-Avoid=eliminate(getoutofsituation)-Reduce=institutecontrols-Share=partnerwithsomeone(e.g.insurance)Residualrisk(unmitigatedrisk––e.g.shrinkage)IDENTIFYRISKRESPONSESImpactvs.ProbabilityControlShareMitigate&ControlAcceptHighRiskMediumRiskMediumRiskLowRiskLowHighHighIMPACTPROBABILITYLowHighHighIMPACTPROBABILITYHighRiskMediumRiskMediumRiskLowRiskExample:CallCenterRiskAssessmentLossofphonesLossofcomputersCreditriskCustomerhasalongwaitCustomercan’’tgetthroughCustomercan’’tgetanswersEntryerrorsEquipmentobsolescenceRepeatcallsforsameproblemFraudLosttransactionsEmployeemoraleControlRiskControlObjectiveActivityCompletenessMaterialAccrualoftransactionopenliabilitiesnotrecordedInvoicesaccruedafterclosingIssue:InvoicesgotofieldandAPisnotawareofliability.Example:AccountsPayableProcessDashboardofrisksandrelatedresponses(visualstatusofwherekeyrisksstandrelativetorisktolerances)FlowchartsofprocesseswithkeycontrolsnotedNarrativesofbusinessobjectiveslinkedtooperationalrisksandresponsesListofkeyriskstobemonitoredorusedManagementunderstandingofkeybusinessriskresponsibilityandcommunicationofassignmentsCommunicateResultsMonitorCollectanddisplayinformationPerformanalysis-Risksarebeingproperlyaddressed-ControlsareworkingtomitigaterisksAccountabilityforrisksOwnershipUpdates-