Rabin K. Acharya PhD (MPhil,MBA,MPA,MA), profile picture
Uploaded byRabin K. Acharya PhD (MPhil,MBA,MPA,MA)
PPTX, PDF222 views

Entetrprise risk management process

The document discusses the risk management process, including key drivers, risk analysis, risk identification by source, and risk assessment. It describes the main steps and considerations for risk analysis, including quantitative and qualitative approaches. It also outlines some common sources to identify risks, such as risk registers, audit reports, impact analyses, reviews, and analytical tools like SWOT and PESTLE. Effective risk management requires identifying risks from multiple sources, analyzing their likelihood and potential impact, and ongoing monitoring and assessment.

Embed presentation

Downloaded 14 times
The Risk Management Process
The Risk Management Process • The Drivers • Risk Analysis • Risk Identification by Source • Risk Impact • Risk Assessment • Risk Control and Treatment • Internal Audit
KEY DRIVERS FOR ENTERPRISE RISK MANAGEMENT
Key Drivers for Enterprise Risk Management • Risk Management Strategy • Risk Ownership • Risk Management Competency • Decision Making • Daily Operations • Continuous Monitoring • Periodic Monitoring
Risk Management Strategy • The first step before starting with all the concepts that come with risk management such as identification, analysis, and mitigation, is to decide on the risk management priorities of the organization. • Along with the priorities, companies also need to gain a better understanding of the following: – Their business objective – The approach they want to take toward risk management – The risk governance structure they want to create – Size and complexity of their business model
Risk Ownership • The person who executes risk responses is often the one who gets assigned with ownership of the risk. This is not just about accountability. • There are two aspects to risk management: – Head of risk management function: • His role is to communicate, coordinate, and administer all the risk management policies and processes of the company. He is also in charge of identifying and mitigating material risks by the risk owners – Risk owner: • He is the one who is actually in charge of managing risks and reports to the head responsible for a risk management function in an organization • The risk owner should not be held responsible for monitoring the effectiveness of the risk response. His job is to make sure the risk response is adjusted within the risk appetite of the domain he is in charge of.
Risk Management Competency • There are four types of responsibilities that come with risk management, which are: – People in charge of risk governance – People in charge of risk management – People in charge of risk responses – People in charge of reporting how effective the risk responses were • All four profiles in risk management need to be trained appropriately so that they have the right skillset and experience to perform their job roles effectively.
Decision Making • Making mistakes in the strategy formulation phase itself can have a big impact on how effective the risk management process is. • A lot of risk management efforts are usually focused on risks during and after the implementation of ERM but forget the mistakes and risks in the strategic choices made beforehand. • Risk management should be applied while the decision-making stage is underway so that all employees have a thorough understanding of the risks that come with each decision they make.
Daily Operations • The risk management platform should be enterprise- wide. This means it has to include all day-to-day operations as well to ensure effective and efficient execution. • In fact, risk management procedures and policies should become a part of training for all new employees so that they join the company with an appropriate risk culture. • 66% of executives believe that the biggest priority for financial institutions with an enterprise risk management solution is the collaboration between business units and the risk management function.
Continuous Monitoring • Depending on the size and functions of the business organizations, there should be processes in place that are continuously monitoring the performance of the enterprise risk management system. • This will make sure reports on risk responses are going to risk owners and people in charge of risk governance in a timely manner. • This is a very important key driver because it ensures that the company stays within their risk appetite and is always in line with all the regulatory policies.
Periodic Monitoring • The biggest challenge for companies when it comes to compliance is “continuing regulatory change”. • To ensure compliance with all the policies and procedures, there needs to be an internal audit with enough resources and skills that monitors all processes periodically. • The internal audit unit needs to have direct access to the Audit Committee to ensure everything is done above board.
Periodic Monitoring • There has to be a collaboration between the internal audit unit and the risk management unit. • It is very important for the internal audit unit to understand all key risk areas to improve their reviews. • The risk management unit needs to work with the internal audit department to make sure that all the necessary actions are being taken on time and their accuracy.
Culture and Board Oversight • There has to be a proper risk culture created across the organization to ensure the effective implementation of risk management. • The upper management and the board of directors need to work together to create different guidelines so that there is a strong risk culture environment created in the company.
CONCLUSION Effective risk management can only take place when all departments of the company are trained to assess and manage risks. They need to work together to ensure the company achieves its business objectives on time and stays compliant throughout. These drivers are important pillars of a successful enterprise risk management implementation.
RISK ANALYSIS
Continued… • Risk analysis is the process of assessing the likelihood of an adverse event occurring within the corporate, government, or environmental sector. • Risk analysis is the study of the underlying uncertainty of a given course of action and refers to the uncertainty of forecasted cash flow streams, the variance of portfolio or stock returns, the probability of a project's success or failure, and possible future economic states. • Risk analysts often work in tandem with forecasting professionals to minimize future negative unforeseen effects.
Continued… • Risk analysis is the process of assessing the likelihood of an adverse event occurring within the corporate, government, or environmental sector. • Risk can be analysed using several approaches including those that fall under the categories of quantitative and qualitative. • Risk analysis is still more of an art than a science.
Understanding Risk Analysis • A risk analyst starts by identifying what could go wrong. • The negative events that could occur are then weighed against a probability metric to measure the likelihood of the event occurring • Finally, risk analysis attempts to estimate the extent of the impact that will be made if the event happens.
Quantitative Risk Analysis • Risk analysis can be quantitative or qualitative. • Under quantitative risk analysis, a risk model is built using simulation or deterministic statistics to assign numerical values to risk. • Inputs that are mostly assumptions and random variables are fed into a risk model. • For any given range of input, the model generates a range of output or outcome. • The model is analyzed using graphs, scenario analysis, and/or sensitivity analysis by risk managers to make decisions to mitigate and deal with the risks.
Quantitative Risk Analysis Continued .. • A Monte Carlo simulation can be used to generate a range of possible outcomes of a decision made or action taken. • The simulation is a quantitative technique that calculates results for the random input variables repeatedly, using a different set of input values each time. • The resulting outcome from each input is recorded, and the final result of the model is a probability distribution of all possible outcomes. • The outcomes can be summarized on a distribution graph showing some measures of central tendency such as the mean and median, and assessing the variability of the data through standard deviation and variance. • The outcomes can also be assessed using risk management tools such as scenario analysis and sensitivity tables. • A scenario analysis shows the best, middle, and worst outcome of any event. • Separating the different outcomes from best to worst provides a reasonable spread of insight for a risk manager.
Qualitative Risk Analysis • Qualitative risk analysis is an analytical method that does not identify and evaluate risks with numerical and quantitative ratings. • Qualitative analysis involves a written definition of the uncertainties, an evaluation of the extent of the impact (if the risk ensues), and countermeasure plans in the case of a negative event occurring. • Examples of qualitative risk tools include SWOT Analysis, Cause and Effect diagrams, Decision Matrix, Game Theory, etc. • A firm that wants to measure the impact of a security breach on its servers may use a qualitative risk technique to help prepare it for any lost income that may occur from a data breach.
RISK IDENTIFICATION BY SOURCE
Identifying risks is a key step in a proactive risk management process. Source Description Risk registers and risk reports Provide a foundation for evaluating existing risks and their potential risk to an objective. Issues log Record of issues faced and the actions taken to resolve them. Any issues that were formally identified as risks should be analysed. Audit reports Independent view of adherence to regulatory guidelines including a review of compliance preparations, security policies, access controls and management of risks. Business Impact Analysis (BIA) Detailed risk analysis that examines the nature and extent of disruptions and the likelihood of the resulting consequences. Internal & external reviews Reviews undertaken to evaluate the suitability, adequacy and effectiveness of the department’s systems, and to look for improvement opportunities.
Continued… SWOT analysis: (Strength, Weakness, Opportunity Threats) Commonly used as a planning tool for analysing a business, its resources and its environment by looking at internal strengths and weaknesses; and opportunities and threats in the external environment PESTLE (Political, Economic, Sociological, Technological, Legal, Environmental) Commonly used as a planning tool to identify and categorise threats in the external environment (political, economic, social, technological, legal, environmental) Brainstorming Creative technique to gather risks spontaneously by group members. Group members verbally identify risks in a ‘no wrong answer’ environment. This technique provides the opportunity for group members to build on each other’s ideas Scenario analysis Uses possible (often extreme) future events to anticipate how threats and opportunities might develop. Surveys/Questionna ires Gather data on risks. Surveys rely on the questions asked.
Continued… One-on-one interviews Discussions with stakeholders to identify/explore risk areas and detailed or sensitive information about the risk. Stakeholder analysis Process of identifying individuals or groups who have a vested interest in the objectives and ascertaining how to engage with them to better understand the objective and its associated uncertainties Working groups Useful to surface detailed information about the risks i.e. source, causes, consequences, stakeholder impacted, existing controls Corporate knowledge History of risks provide insight into future threats or opportunities through: • Experiential knowledge – collection of information that a person has obtained through their experience. • Documented knowledge – collection of information or data that has been documented about a particular subject. • Lessons learned – knowledge that has been organised into information that may be relevant to the different areas within the organisation.
Continuation… Process analysis An approach that helps improve the performance of business activities by analysing current processes and making decisions on new improvements. Other jurisdictions Issues experienced and risks identified by other jurisdictions should be identified and evaluated. If it can happen to them, it can happen here.
What information should we collect during the risk identification step? • Identifying risks involves considering what, when, why, where and how things can happen. More specifically:
What are the sources of risk or threat the things which have the inherent potential to harm or facilitate harm. What could happen events or incidents that could occur whereby the source of risk or threat has an impact on the achievement of objectives. Where the physical locations/assets where the event could occur or where the direct or indirect consequences may be experienced. When specific times or time periods when the event is likely to occur and/or the consequences realised. How the manner or method in which the risk event or incident could occur. Causes what are the direct and indirect factors that create the source of risk or threat. Business consequences what would be the impact on objectives if the risk was realised. Business areas/stakeholders affected what parts of the organisation and what stakeholders might be involved or impacted? Existing controls a preliminary review of existing controls should be undertaken to identify o What controls currently exist to minimise the likelihood and consequences of each risk? o What vulnerabilities exist that could undermine the effectiveness of the controls?
Risk Impact • Health and Safety • Quality of Life • Sustainability • Financial • Time • Reputation
Basic form of the Risk Impact/Probability Chart Low impact/low probability Risks in the bottom left corner are low level, and you can often ignore them. Low impact/high probability Risks in the top left corner are of moderate importance – if these things happen, you can cope with them and move on. However, you should try to reduce the likelihood that they'll occur. High impact/low probability Risks in the bottom right corner are of high importance if they do occur, but they're very unlikely to happen. For these, however, you should do what you can to reduce the impact they'll have if they do occur, and you should have contingency plans in place just in case they do. High impact/high probability Risks towards the top right corner are of critical importance. These are your top priorities, and are risks that you must pay close attention to.
RISK CONTROL AND TREATMENT
Risk Controls • Risk control is a plan-based business strategy that aims to identify, assess, and prepare for any dangers, hazards, and other potentials for disaster—both physical and figurative—that may interfere with an organization's operations and objectives.
Risk Controls • There are three main types of internal controls: – detective, – preventative, and – corrective. • Controls are typically policies and procedures or technical safeguards that are implemented to prevent problems and protect the assets of an organization. • All organizations are subject to threats occurring that unfavourably impact the organization and affect asset loss. From innocent but costly mistakes, to fraudulent manipulation, risks are present in every business. Regardless of why it transpires, controls need to be established to avoid or minimize loss to the organization. • There are also limitations to these controls to consider, making it essential to have on-going reviews and monitoring of your system.
Detective internal controls • Detective internal controls are those controls that are used after the fact of a discretionary event. Think of Sherlock Holmes, walking onto the scene of an event, trying to piece together what happened. • What caused the event to occur? • What process failed that allowed the event to occur? • Is there a policy that can be implemented to keep the event from happening again in the future? • Some examples of detective controls are internal audits, reviews, reconciliations, financial reporting, financial statements, and physical inventories.
Preventative internal controls • Preventative internal controls are those controls put in place to avert a negative event from occurring. For example, most applications have checks and balances built-in to avoid or minimize entering incorrect information. There are also physical controls or administrative preventive controls, such as segregation of duties that are routinely performed by companies. • Assigning one person to write checks, and another staff member to authorize the payments, are segregation of duties that fall under the umbrella of preventative controls from an administrative standpoint. Others, like video surveillance or posting security guards at entry points verifying ID credentials and restricting access, are illustrative of physical safeguards. • Training programs, drug testing, firewalls, computer and server backups are all types of preventative internal controls that avoid asset loss and undesirable events from occurring.
Corrective internal controls • Corrective internal controls are typically those controls put in place after the detective internal controls discover a problem. These controls could include disciplinary action, reports filed, software patches or modifications, and new policies prohibiting practices such as employee tailgating. They are usually put into place after discovering the reasons why they occurred in the first place.
Limitations of internal controls • Unfortunately, processes and control activities are not perfect, and mistakes and problems will be found. An on- going review and analysis of the internal controls should be part of any organization’s regular processes. • When a problem occurs, it should be documented and reviewed by those who can take the corrective actions discussed above and improve the system. • There will always be limitations with humans involved. • People make mistakes and will often find weaknesses in the control procedures, whether by accident or with intent. • It’s important to keep this in mind when considering internal controls.
RISK TREATMENT
Risk Treatment Strategy • Avoidance • Reduction • Transfer • Acceptance • Sharing
Residual Risk The residual risk is the amount of risk or danger associated with an action or event remaining after natural or inherent risks have been reduced by risk controls. The general formula to calculate residual risk is where the general concept of risk is or, alternatively. residual risks are not particularly worrying, organizations cannot completely ignore them and should address them through: Identification of relevant governance, risk, and compliance requirements. • Recognition of existing risks. • Determination of the strengths and weaknesses of the organization’s control framework. • Planning for appropriate contingencies. Secondary Risk A secondary risk can be defined as a risk created by the response to another risk. In other words, the secondary risk is a consequence of dealing with the original risk.
What is the difference between secondary and residual risks? • Secondary risks are those that occur as a direct result of implementing a risk response. • On the other hand, it is expected that the residual risks will remain after the expected risk response. • The emergency plan is used to manage primary or secondary risks. • The backup plan is used to manage residual risks. Note that if an identified risk occurs, the emergency plan is implemented and, if it becomes ineffective, the reserve plan is implemented. • If residual risks and secondary risks do not require a response plan, they will be monitored as they occur.
INTERNAL AUDIT
What is an Internal Audit? • Internal audits evaluate a company’s internal controls, including its corporate governance and accounting processes. • These audits ensure compliance with laws and regulations and help to maintain accurate and timely financial reporting and data collection. • Internal audits also provide management with the tools necessary to attain operational efficiency by identifying problems and correcting lapses before they are discovered in an external audit.
Continuation.. • An internal audit offers risk management and evaluates the effectiveness of a company’s internal controls, corporate governance, and accounting processes. • Internal audits provide Management and Board of Directors with a value-added service where flaws in a process may be caught and corrected prior to external audits. • The tax/governance rules holds management responsible for their financial statements by requiring senior corporate officers to certify in writing that the financials are accurately presented
Internal Audit Process • Internal auditors generally identify a department, gather an understanding of the current internal control process, conduct fieldwork testing, follow up with department staff about identified issues, prepare an official audit report, review the audit report with management, and follow up with management and the board of directors as needed to ensure recommendations have been implemented.
Assessment Techniques • Assessment techniques ensure an internal auditor gathers a full understanding of the internal control procedures and whether employees are complying with internal control directives. • To avoid disrupting the daily workflow, auditors begin with indirect assessment techniques, such as reviewing flowcharts, manuals, departmental control policies or other existing documentation. • If documented procedures are not being followed, direct discussion with department staff may be necessary.
Analysis Techniques • Auditing fieldwork procedures can include transaction matching, physical inventory count, audit trail calculations, and account reconciliation as is required by law. • Analysis techniques may test random data or target specific data, if an auditor believes an internal control process needs to be improved.
Reporting Procedures • Internal audit reporting includes a formal report and may include a preliminary or memo-style interim report. • An interim report typically includes sensitive or significant results the auditor thinks the board of directors needs to know right away. • The final report includes a summary of the procedures and techniques used for completing the audit, a description of audit findings, and suggestions for improvements to internal controls and control procedures. • The formal report is reviewed with management and recommendations for improvement are discussed. • Follow up after a period of time is necessary to ensure the new recommendations have been implemented and have improved operating efficiency.
Questions

More Related Content

PDF
Operational Risk Management
byarsqureshi
 
PDF
ERM-Enterprise Risk Management
byJorge Vaz Girão , CISA, PMP, PMDPro I, ERMCP
 
PPTX
Governance risk and compliance
byMagdalena Matell
 
PPTX
Risk Management
byStefan Csosz
 
PPTX
Risk management ppt 111p (training module)
bySadia Razzaq
 
PDF
Risk Appetite
byTowers Perrin
 
PDF
Operational Risk Management under BASEL era
byTreat Risk
 
PPTX
OPERATIONAL RISK MANAGEMENT FRAMEWORK PRESENTATION
byFrackson Kathibula-Nyoni
 
Operational Risk Management
byarsqureshi
 
ERM-Enterprise Risk Management
byJorge Vaz Girão , CISA, PMP, PMDPro I, ERMCP
 
Governance risk and compliance
byMagdalena Matell
 
Risk Management
byStefan Csosz
 
Risk management ppt 111p (training module)
bySadia Razzaq
 
Risk Appetite
byTowers Perrin
 
Operational Risk Management under BASEL era
byTreat Risk
 
OPERATIONAL RISK MANAGEMENT FRAMEWORK PRESENTATION
byFrackson Kathibula-Nyoni
 

What's hot

PPTX
Iso27001 Risk Assessment Approach
bytschraider
 
PDF
How to Build an Enterprise Risk Management Framework
byColleen Beck-Domanico
 
PPT
Chapter 1 risk management (3)
byrafeeqameen
 
PPTX
Operational Risk Management - A Gateway to managing the risk profile of your...
byEneni Oduwole
 
PPTX
Risk management
byHarold Malamion
 
PPTX
Risk management
byManish Tiwari
 
PPTX
Strategic Risk Management as a CFO: Getting Risk Management Right
byProformative, Inc.
 
PDF
Risk appetite
byMichel Rochette
 
PPT
Risk Culture
byIan-Edward Stafrace
 
PPT
Internal Control & Risk Management Framework
byTreasury Consulting LLP
 
PDF
Enterprise Risk Management - Aligning Risk with Strategy and Performance
byResolver Inc.
 
PPTX
Credit Risk Management
byMaryum Sarwar
 
PPTX
Risk Management
byShahan Ullah
 
PPTX
Risk culture presentation
byBenjamin Kpodo
 
PPTX
Key risk indicators shareslide
byZakaria Salah, Ph.D,MBA
 
PPT
ICAAP - IBANK
byibankuk
 
PDF
Risk Management Overview
byJIGNESH PADIA
 
PDF
01-penetapan-konteks.pdf
byDeviSuryono1
 
PDF
Riskpro - Operational Risk Management
byManoj Jain
 
PDF
Risk management process
byeduCBA
 
Iso27001 Risk Assessment Approach
bytschraider
 
How to Build an Enterprise Risk Management Framework
byColleen Beck-Domanico
 
Chapter 1 risk management (3)
byrafeeqameen
 
Operational Risk Management - A Gateway to managing the risk profile of your...
byEneni Oduwole
 
Risk management
byHarold Malamion
 
Risk management
byManish Tiwari
 
Strategic Risk Management as a CFO: Getting Risk Management Right
byProformative, Inc.
 
Risk appetite
byMichel Rochette
 
Risk Culture
byIan-Edward Stafrace
 
Internal Control & Risk Management Framework
byTreasury Consulting LLP
 
Enterprise Risk Management - Aligning Risk with Strategy and Performance
byResolver Inc.
 
Credit Risk Management
byMaryum Sarwar
 
Risk Management
byShahan Ullah
 
Risk culture presentation
byBenjamin Kpodo
 
Key risk indicators shareslide
byZakaria Salah, Ph.D,MBA
 
ICAAP - IBANK
byibankuk
 
Risk Management Overview
byJIGNESH PADIA
 
01-penetapan-konteks.pdf
byDeviSuryono1
 
Riskpro - Operational Risk Management
byManoj Jain
 
Risk management process
byeduCBA
 

Similar to Entetrprise risk management process

PDF
ASSESSING THE RELATIONSHIP EFFECTIVE RISK ANALYSIS HAVE ON BUSINESS SUCCESS
byRobin Beregovska
 
PDF
Proposal To Chairman For Risk Management Services
byRahul Bhan (CA, CIA, MBA)
 
PDF
Proposal To Chairman For Risk Management Services
byRahul Bhan (CA, CIA, MBA)
 
PPTX
Chapter 1 - Risk Management - 2nd Semester - M.Com - Bangalore University
bySwaminath Sam
 
PPTX
Risk Management and Control(Insurance).pptx
bymuthukrishnaveni anand
 
PDF
Session 14 - Project Risk Management.pdf
byafghancosmoscapacity
 
PPTX
Risk Management with technology involvement.pptx
byraalalmanzorucl
 
PPTX
1-.Teklay-EFFORT (PPT) -April-2025- Risk Mgnt Top Mgmnt -Breifing.PPTX
byteklayweldegerima1
 
PPTX
Information Security Risk Management
byNikhil Soni
 
PDF
risk managemeبسیبسشبیسشبسشیبسشیبشسیبnt.pdf
byahmadiwahidullah666
 
PPTX
2159_Unit III Risk Management- PART I.pptx
byssuser4f7e3f
 
PPTX
Introduction to risk management
byMukund Sreeram
 
PPTX
Top 5 Risk Management Topics for Students
byLesa Cote
 
PDF
ppt erm.pdf
byRJ231
 
PPTX
Risk Management Policy Risk Index Risk assessment
bymdirfanuddin1322
 
PPT
12_BUSINESS RISK ufuhf isbifb MANAGEMENT.ppt
bybillugamma06
 
PPTX
Trustee Conference AM4: Effectively managing risk
byNCVO - National Council for Voluntary Organisations
 
PDF
Beyond PMP: Risk Management
byabhinayverma
 
PDF
STRATEGIC RISK ADVISORY SOLUTIONS_Risk Management_Newsletter
byDion K Hamilton
 
PPTX
COSO Vs ERM - NMIMS INDORE
byNaresh Parandhaman
 
ASSESSING THE RELATIONSHIP EFFECTIVE RISK ANALYSIS HAVE ON BUSINESS SUCCESS
byRobin Beregovska
 
Proposal To Chairman For Risk Management Services
byRahul Bhan (CA, CIA, MBA)
 
Proposal To Chairman For Risk Management Services
byRahul Bhan (CA, CIA, MBA)
 
Chapter 1 - Risk Management - 2nd Semester - M.Com - Bangalore University
bySwaminath Sam
 
Risk Management and Control(Insurance).pptx
bymuthukrishnaveni anand
 
Session 14 - Project Risk Management.pdf
byafghancosmoscapacity
 
Risk Management with technology involvement.pptx
byraalalmanzorucl
 
1-.Teklay-EFFORT (PPT) -April-2025- Risk Mgnt Top Mgmnt -Breifing.PPTX
byteklayweldegerima1
 
Information Security Risk Management
byNikhil Soni
 
risk managemeبسیبسشبیسشبسشیبسشیبشسیبnt.pdf
byahmadiwahidullah666
 
2159_Unit III Risk Management- PART I.pptx
byssuser4f7e3f
 
Introduction to risk management
byMukund Sreeram
 
Top 5 Risk Management Topics for Students
byLesa Cote
 
ppt erm.pdf
byRJ231
 
Risk Management Policy Risk Index Risk assessment
bymdirfanuddin1322
 
12_BUSINESS RISK ufuhf isbifb MANAGEMENT.ppt
bybillugamma06
 
Trustee Conference AM4: Effectively managing risk
byNCVO - National Council for Voluntary Organisations
 
Beyond PMP: Risk Management
byabhinayverma
 
STRATEGIC RISK ADVISORY SOLUTIONS_Risk Management_Newsletter
byDion K Hamilton
 
COSO Vs ERM - NMIMS INDORE
byNaresh Parandhaman
 

Recently uploaded

PPTX
Explore Hubspot’s Customer Agent for B2B
byBoundify
 
PDF
Trusted Place to Buying Verified PayPal Accounts in Los Angeles.pdf
byBuyVerifiedCashAppAc898153
 
PDF
Benefits Quarterly, Vol. 37, Fourth Quarter 2021.pdf
byHenry Tapper
 
PDF
apidays Australia 2025 | Value Dynamics Mapping - Making Value Visible
byapidays
 
DOCX
Buy Verified PayPal Accounts for Secure Online Use docx
bymugdhobiswas17
 
PDF
17 Guide to Buying Verified Binance Accounts in the US.pdf
byhttps://pvaisback.com/product/buy-old-gmail-accounts/
 
DOCX
Buy Old Gmail Accounts – A Detailed Guide.docx
byPremium Phone Verified Account Providers
 
PDF
OIL CHECK 500 Portable - Air Quality Monitoring System
byCS Instruments
 
PDF
Nicky Oppenheimer World Economic Forum Jan 2000
byJames AH Campbell
 
PDF
Equinox Gold - January Investor Presentation.pdf
byEquinox Gold Corp.
 
PDF
Kirill Klip GEM Royalty TNR Gold Lithium Presentation
byKirill Klip
 
PDF
Using-pension-savings-to-support-home-ownership.pdf
byHenry Tapper
 
PDF
Buy Proton Mail Accounts _ Secure Email Accounts In 2026.pdf
byhttps://pvaallit.com/product/buy-verified-apple-pay-accounts/
 
PDF
First Equity BOD New Copper Licences 26 Jan 2026
byJames AH Campbell
 
PDF
Best Top 3 Sites to Buy Google Reviews (5-Star & Non-Drop).pdf
byhttps://pvaallit.com/product/buy-google-5-star-reviews/
 
PDF
Camil Institutional Presentation_Jan26.pdf
byCAMILRI
 
PDF
How Unlock Buy Verified Cash App Accounts?
byWei Huang
 
PDF
Kirill Klip GEM Royalty TNR Gold Copper Presentation
byKirill Klip
 
PDF
enterprise software is not dead and here is why
bywangbin26
 
DOCX
How Verified Cash App Accounts Work and How to Buy.docx
byhttps://pvaisback.com/product/buy-old-gmail-accounts/
 
Explore Hubspot’s Customer Agent for B2B
byBoundify
 
Trusted Place to Buying Verified PayPal Accounts in Los Angeles.pdf
byBuyVerifiedCashAppAc898153
 
Benefits Quarterly, Vol. 37, Fourth Quarter 2021.pdf
byHenry Tapper
 
apidays Australia 2025 | Value Dynamics Mapping - Making Value Visible
byapidays
 
Buy Verified PayPal Accounts for Secure Online Use docx
bymugdhobiswas17
 
17 Guide to Buying Verified Binance Accounts in the US.pdf
byhttps://pvaisback.com/product/buy-old-gmail-accounts/
 
Buy Old Gmail Accounts – A Detailed Guide.docx
byPremium Phone Verified Account Providers
 
OIL CHECK 500 Portable - Air Quality Monitoring System
byCS Instruments
 
Nicky Oppenheimer World Economic Forum Jan 2000
byJames AH Campbell
 
Equinox Gold - January Investor Presentation.pdf
byEquinox Gold Corp.
 
Kirill Klip GEM Royalty TNR Gold Lithium Presentation
byKirill Klip
 
Using-pension-savings-to-support-home-ownership.pdf
byHenry Tapper
 
Buy Proton Mail Accounts _ Secure Email Accounts In 2026.pdf
byhttps://pvaallit.com/product/buy-verified-apple-pay-accounts/
 
First Equity BOD New Copper Licences 26 Jan 2026
byJames AH Campbell
 
Best Top 3 Sites to Buy Google Reviews (5-Star & Non-Drop).pdf
byhttps://pvaallit.com/product/buy-google-5-star-reviews/
 
Camil Institutional Presentation_Jan26.pdf
byCAMILRI
 
How Unlock Buy Verified Cash App Accounts?
byWei Huang
 
Kirill Klip GEM Royalty TNR Gold Copper Presentation
byKirill Klip
 
enterprise software is not dead and here is why
bywangbin26
 
How Verified Cash App Accounts Work and How to Buy.docx
byhttps://pvaisback.com/product/buy-old-gmail-accounts/
 

Entetrprise risk management process

  • 1.
  • 2.
    The Risk ManagementProcess • The Drivers • Risk Analysis • Risk Identification by Source • Risk Impact • Risk Assessment • Risk Control and Treatment • Internal Audit
  • 3.
    KEY DRIVERS FORENTERPRISE RISK MANAGEMENT
  • 4.
    Key Drivers forEnterprise Risk Management • Risk Management Strategy • Risk Ownership • Risk Management Competency • Decision Making • Daily Operations • Continuous Monitoring • Periodic Monitoring
  • 5.
    Risk Management Strategy •The first step before starting with all the concepts that come with risk management such as identification, analysis, and mitigation, is to decide on the risk management priorities of the organization. • Along with the priorities, companies also need to gain a better understanding of the following: – Their business objective – The approach they want to take toward risk management – The risk governance structure they want to create – Size and complexity of their business model
  • 6.
    Risk Ownership • Theperson who executes risk responses is often the one who gets assigned with ownership of the risk. This is not just about accountability. • There are two aspects to risk management: – Head of risk management function: • His role is to communicate, coordinate, and administer all the risk management policies and processes of the company. He is also in charge of identifying and mitigating material risks by the risk owners – Risk owner: • He is the one who is actually in charge of managing risks and reports to the head responsible for a risk management function in an organization • The risk owner should not be held responsible for monitoring the effectiveness of the risk response. His job is to make sure the risk response is adjusted within the risk appetite of the domain he is in charge of.
  • 7.
    Risk Management Competency •There are four types of responsibilities that come with risk management, which are: – People in charge of risk governance – People in charge of risk management – People in charge of risk responses – People in charge of reporting how effective the risk responses were • All four profiles in risk management need to be trained appropriately so that they have the right skillset and experience to perform their job roles effectively.
  • 8.
    Decision Making • Makingmistakes in the strategy formulation phase itself can have a big impact on how effective the risk management process is. • A lot of risk management efforts are usually focused on risks during and after the implementation of ERM but forget the mistakes and risks in the strategic choices made beforehand. • Risk management should be applied while the decision-making stage is underway so that all employees have a thorough understanding of the risks that come with each decision they make.
  • 9.
    Daily Operations • Therisk management platform should be enterprise- wide. This means it has to include all day-to-day operations as well to ensure effective and efficient execution. • In fact, risk management procedures and policies should become a part of training for all new employees so that they join the company with an appropriate risk culture. • 66% of executives believe that the biggest priority for financial institutions with an enterprise risk management solution is the collaboration between business units and the risk management function.
  • 10.
    Continuous Monitoring • Dependingon the size and functions of the business organizations, there should be processes in place that are continuously monitoring the performance of the enterprise risk management system. • This will make sure reports on risk responses are going to risk owners and people in charge of risk governance in a timely manner. • This is a very important key driver because it ensures that the company stays within their risk appetite and is always in line with all the regulatory policies.
  • 11.
    Periodic Monitoring • Thebiggest challenge for companies when it comes to compliance is “continuing regulatory change”. • To ensure compliance with all the policies and procedures, there needs to be an internal audit with enough resources and skills that monitors all processes periodically. • The internal audit unit needs to have direct access to the Audit Committee to ensure everything is done above board.
  • 12.
    Periodic Monitoring • Therehas to be a collaboration between the internal audit unit and the risk management unit. • It is very important for the internal audit unit to understand all key risk areas to improve their reviews. • The risk management unit needs to work with the internal audit department to make sure that all the necessary actions are being taken on time and their accuracy.
  • 13.
    Culture and BoardOversight • There has to be a proper risk culture created across the organization to ensure the effective implementation of risk management. • The upper management and the board of directors need to work together to create different guidelines so that there is a strong risk culture environment created in the company.
  • 14.
    CONCLUSION Effective risk managementcan only take place when all departments of the company are trained to assess and manage risks. They need to work together to ensure the company achieves its business objectives on time and stays compliant throughout. These drivers are important pillars of a successful enterprise risk management implementation.
  • 15.
  • 16.
    Continued… • Risk analysisis the process of assessing the likelihood of an adverse event occurring within the corporate, government, or environmental sector. • Risk analysis is the study of the underlying uncertainty of a given course of action and refers to the uncertainty of forecasted cash flow streams, the variance of portfolio or stock returns, the probability of a project's success or failure, and possible future economic states. • Risk analysts often work in tandem with forecasting professionals to minimize future negative unforeseen effects.
  • 17.
    Continued… • Risk analysisis the process of assessing the likelihood of an adverse event occurring within the corporate, government, or environmental sector. • Risk can be analysed using several approaches including those that fall under the categories of quantitative and qualitative. • Risk analysis is still more of an art than a science.
  • 18.
    Understanding Risk Analysis •A risk analyst starts by identifying what could go wrong. • The negative events that could occur are then weighed against a probability metric to measure the likelihood of the event occurring • Finally, risk analysis attempts to estimate the extent of the impact that will be made if the event happens.
  • 19.
    Quantitative Risk Analysis •Risk analysis can be quantitative or qualitative. • Under quantitative risk analysis, a risk model is built using simulation or deterministic statistics to assign numerical values to risk. • Inputs that are mostly assumptions and random variables are fed into a risk model. • For any given range of input, the model generates a range of output or outcome. • The model is analyzed using graphs, scenario analysis, and/or sensitivity analysis by risk managers to make decisions to mitigate and deal with the risks.
  • 20.
    Quantitative Risk Analysis Continued.. • A Monte Carlo simulation can be used to generate a range of possible outcomes of a decision made or action taken. • The simulation is a quantitative technique that calculates results for the random input variables repeatedly, using a different set of input values each time. • The resulting outcome from each input is recorded, and the final result of the model is a probability distribution of all possible outcomes. • The outcomes can be summarized on a distribution graph showing some measures of central tendency such as the mean and median, and assessing the variability of the data through standard deviation and variance. • The outcomes can also be assessed using risk management tools such as scenario analysis and sensitivity tables. • A scenario analysis shows the best, middle, and worst outcome of any event. • Separating the different outcomes from best to worst provides a reasonable spread of insight for a risk manager.
  • 21.
    Qualitative Risk Analysis •Qualitative risk analysis is an analytical method that does not identify and evaluate risks with numerical and quantitative ratings. • Qualitative analysis involves a written definition of the uncertainties, an evaluation of the extent of the impact (if the risk ensues), and countermeasure plans in the case of a negative event occurring. • Examples of qualitative risk tools include SWOT Analysis, Cause and Effect diagrams, Decision Matrix, Game Theory, etc. • A firm that wants to measure the impact of a security breach on its servers may use a qualitative risk technique to help prepare it for any lost income that may occur from a data breach.
  • 22.
  • 23.
    Identifying risks isa key step in a proactive risk management process. Source Description Risk registers and risk reports Provide a foundation for evaluating existing risks and their potential risk to an objective. Issues log Record of issues faced and the actions taken to resolve them. Any issues that were formally identified as risks should be analysed. Audit reports Independent view of adherence to regulatory guidelines including a review of compliance preparations, security policies, access controls and management of risks. Business Impact Analysis (BIA) Detailed risk analysis that examines the nature and extent of disruptions and the likelihood of the resulting consequences. Internal & external reviews Reviews undertaken to evaluate the suitability, adequacy and effectiveness of the department’s systems, and to look for improvement opportunities.
  • 24.
    Continued… SWOT analysis: (Strength, Weakness, Opportunity Threats) Commonly usedas a planning tool for analysing a business, its resources and its environment by looking at internal strengths and weaknesses; and opportunities and threats in the external environment PESTLE (Political, Economic, Sociological, Technological, Legal, Environmental) Commonly used as a planning tool to identify and categorise threats in the external environment (political, economic, social, technological, legal, environmental) Brainstorming Creative technique to gather risks spontaneously by group members. Group members verbally identify risks in a ‘no wrong answer’ environment. This technique provides the opportunity for group members to build on each other’s ideas Scenario analysis Uses possible (often extreme) future events to anticipate how threats and opportunities might develop. Surveys/Questionna ires Gather data on risks. Surveys rely on the questions asked.
  • 25.
    Continued… One-on-one interviews Discussions with stakeholdersto identify/explore risk areas and detailed or sensitive information about the risk. Stakeholder analysis Process of identifying individuals or groups who have a vested interest in the objectives and ascertaining how to engage with them to better understand the objective and its associated uncertainties Working groups Useful to surface detailed information about the risks i.e. source, causes, consequences, stakeholder impacted, existing controls Corporate knowledge History of risks provide insight into future threats or opportunities through: • Experiential knowledge – collection of information that a person has obtained through their experience. • Documented knowledge – collection of information or data that has been documented about a particular subject. • Lessons learned – knowledge that has been organised into information that may be relevant to the different areas within the organisation.
  • 26.
    Continuation… Process analysis An approach thathelps improve the performance of business activities by analysing current processes and making decisions on new improvements. Other jurisdictions Issues experienced and risks identified by other jurisdictions should be identified and evaluated. If it can happen to them, it can happen here.
  • 27.
    What information shouldwe collect during the risk identification step? • Identifying risks involves considering what, when, why, where and how things can happen. More specifically:
  • 28.
    What are the sourcesof risk or threat the things which have the inherent potential to harm or facilitate harm. What could happen events or incidents that could occur whereby the source of risk or threat has an impact on the achievement of objectives. Where the physical locations/assets where the event could occur or where the direct or indirect consequences may be experienced. When specific times or time periods when the event is likely to occur and/or the consequences realised. How the manner or method in which the risk event or incident could occur. Causes what are the direct and indirect factors that create the source of risk or threat. Business consequences what would be the impact on objectives if the risk was realised. Business areas/stakeholders affected what parts of the organisation and what stakeholders might be involved or impacted? Existing controls a preliminary review of existing controls should be undertaken to identify o What controls currently exist to minimise the likelihood and consequences of each risk? o What vulnerabilities exist that could undermine the effectiveness of the controls?
  • 29.
    Risk Impact • Healthand Safety • Quality of Life • Sustainability • Financial • Time • Reputation
  • 31.
    Basic form ofthe Risk Impact/Probability Chart Low impact/low probability Risks in the bottom left corner are low level, and you can often ignore them. Low impact/high probability Risks in the top left corner are of moderate importance – if these things happen, you can cope with them and move on. However, you should try to reduce the likelihood that they'll occur. High impact/low probability Risks in the bottom right corner are of high importance if they do occur, but they're very unlikely to happen. For these, however, you should do what you can to reduce the impact they'll have if they do occur, and you should have contingency plans in place just in case they do. High impact/high probability Risks towards the top right corner are of critical importance. These are your top priorities, and are risks that you must pay close attention to.
  • 32.
  • 33.
    Risk Controls • Riskcontrol is a plan-based business strategy that aims to identify, assess, and prepare for any dangers, hazards, and other potentials for disaster—both physical and figurative—that may interfere with an organization's operations and objectives.
  • 34.
    Risk Controls • Thereare three main types of internal controls: – detective, – preventative, and – corrective. • Controls are typically policies and procedures or technical safeguards that are implemented to prevent problems and protect the assets of an organization. • All organizations are subject to threats occurring that unfavourably impact the organization and affect asset loss. From innocent but costly mistakes, to fraudulent manipulation, risks are present in every business. Regardless of why it transpires, controls need to be established to avoid or minimize loss to the organization. • There are also limitations to these controls to consider, making it essential to have on-going reviews and monitoring of your system.
  • 35.
    Detective internal controls •Detective internal controls are those controls that are used after the fact of a discretionary event. Think of Sherlock Holmes, walking onto the scene of an event, trying to piece together what happened. • What caused the event to occur? • What process failed that allowed the event to occur? • Is there a policy that can be implemented to keep the event from happening again in the future? • Some examples of detective controls are internal audits, reviews, reconciliations, financial reporting, financial statements, and physical inventories.
  • 36.
    Preventative internal controls •Preventative internal controls are those controls put in place to avert a negative event from occurring. For example, most applications have checks and balances built-in to avoid or minimize entering incorrect information. There are also physical controls or administrative preventive controls, such as segregation of duties that are routinely performed by companies. • Assigning one person to write checks, and another staff member to authorize the payments, are segregation of duties that fall under the umbrella of preventative controls from an administrative standpoint. Others, like video surveillance or posting security guards at entry points verifying ID credentials and restricting access, are illustrative of physical safeguards. • Training programs, drug testing, firewalls, computer and server backups are all types of preventative internal controls that avoid asset loss and undesirable events from occurring.
  • 37.
    Corrective internal controls •Corrective internal controls are typically those controls put in place after the detective internal controls discover a problem. These controls could include disciplinary action, reports filed, software patches or modifications, and new policies prohibiting practices such as employee tailgating. They are usually put into place after discovering the reasons why they occurred in the first place.
  • 38.
    Limitations of internalcontrols • Unfortunately, processes and control activities are not perfect, and mistakes and problems will be found. An on- going review and analysis of the internal controls should be part of any organization’s regular processes. • When a problem occurs, it should be documented and reviewed by those who can take the corrective actions discussed above and improve the system. • There will always be limitations with humans involved. • People make mistakes and will often find weaknesses in the control procedures, whether by accident or with intent. • It’s important to keep this in mind when considering internal controls.
  • 39.
  • 40.
    Risk Treatment Strategy •Avoidance • Reduction • Transfer • Acceptance • Sharing
  • 41.
    Residual Risk Theresidual risk is the amount of risk or danger associated with an action or event remaining after natural or inherent risks have been reduced by risk controls. The general formula to calculate residual risk is where the general concept of risk is or, alternatively. residual risks are not particularly worrying, organizations cannot completely ignore them and should address them through: Identification of relevant governance, risk, and compliance requirements. • Recognition of existing risks. • Determination of the strengths and weaknesses of the organization’s control framework. • Planning for appropriate contingencies. Secondary Risk A secondary risk can be defined as a risk created by the response to another risk. In other words, the secondary risk is a consequence of dealing with the original risk.
  • 42.
    What is thedifference between secondary and residual risks? • Secondary risks are those that occur as a direct result of implementing a risk response. • On the other hand, it is expected that the residual risks will remain after the expected risk response. • The emergency plan is used to manage primary or secondary risks. • The backup plan is used to manage residual risks. Note that if an identified risk occurs, the emergency plan is implemented and, if it becomes ineffective, the reserve plan is implemented. • If residual risks and secondary risks do not require a response plan, they will be monitored as they occur.
  • 43.
  • 44.
    What is anInternal Audit? • Internal audits evaluate a company’s internal controls, including its corporate governance and accounting processes. • These audits ensure compliance with laws and regulations and help to maintain accurate and timely financial reporting and data collection. • Internal audits also provide management with the tools necessary to attain operational efficiency by identifying problems and correcting lapses before they are discovered in an external audit.
  • 45.
    Continuation.. • An internalaudit offers risk management and evaluates the effectiveness of a company’s internal controls, corporate governance, and accounting processes. • Internal audits provide Management and Board of Directors with a value-added service where flaws in a process may be caught and corrected prior to external audits. • The tax/governance rules holds management responsible for their financial statements by requiring senior corporate officers to certify in writing that the financials are accurately presented
  • 46.
    Internal Audit Process •Internal auditors generally identify a department, gather an understanding of the current internal control process, conduct fieldwork testing, follow up with department staff about identified issues, prepare an official audit report, review the audit report with management, and follow up with management and the board of directors as needed to ensure recommendations have been implemented.
  • 47.
    Assessment Techniques • Assessmenttechniques ensure an internal auditor gathers a full understanding of the internal control procedures and whether employees are complying with internal control directives. • To avoid disrupting the daily workflow, auditors begin with indirect assessment techniques, such as reviewing flowcharts, manuals, departmental control policies or other existing documentation. • If documented procedures are not being followed, direct discussion with department staff may be necessary.
  • 48.
    Analysis Techniques • Auditingfieldwork procedures can include transaction matching, physical inventory count, audit trail calculations, and account reconciliation as is required by law. • Analysis techniques may test random data or target specific data, if an auditor believes an internal control process needs to be improved.
  • 49.
    Reporting Procedures • Internalaudit reporting includes a formal report and may include a preliminary or memo-style interim report. • An interim report typically includes sensitive or significant results the auditor thinks the board of directors needs to know right away. • The final report includes a summary of the procedures and techniques used for completing the audit, a description of audit findings, and suggestions for improvements to internal controls and control procedures. • The formal report is reviewed with management and recommendations for improvement are discussed. • Follow up after a period of time is necessary to ensure the new recommendations have been implemented and have improved operating efficiency.
  • 50.

Editor's Notes

  • #6 Companies should also have an assessment of all the required roles that need to be assigned for effective risk management. This will help in giving out responsibility both in-house and when outsourced.