Recently, there has been an increased focus on the importance of managing risk as part of an overall strong corporate governance and enterprise risk management (ERM) program. With this new emphasis comes a responsibility for Internal Audit to assess the effectiveness of the risk management strategy within the organization. Though there are multiple risk management frameworks, this guide uses ISO 31000 as the basis for the risk assessment. This article discusses management’s role and the types of approaches for Internal Audit to measure the effectiveness of risk management within their organization.
The organization should not conduct the ERM process in isolation. Instead, involve all key stakeholders and use the following control-based assurance framework:
- Effectively identify and appropriately analyze risks.
- Implement adequate and appropriate risk treatment and control.
- Management effectively monitors and reviews processes to detect changes in risks and controls.
The organization’s ERM approach should change over time as internal and external factors change. For example, changes may occur due to the arrival of new personnel, changes in entity structure, new processes, and if the business objective changes. In the same way, the assessment of the ERM process must occur on an ongoing basis.
Responsibilities
Management is responsible for determining the organization’s risk attitude and the Board is responsible for determining if the risk attitude supports the best interests of stakeholders. Internal Audit should assess whether the company’s framework takes into consideration and defines risk management responsibilities and strategy, and whether the elements of the framework allow for building a risk-smart environment while still allowing for responsible risk-taking.
Monitoring and Assurance
Organizations must monitor risk management systems to ensure they are performing as intended. Most organizations accomplish monitoring through ongoing activities, separate evaluations, or a combination of these two methods. Ongoing monitoring is often most effective since it is completed on a real-time basis, can react dynamically to changing conditions, and is ingrained in the organization.
Line management, internal audit, risk management specialists, and the compliance function often share the monitoring responsibility. As a result, it is important for the organization to coordinate assurance activities to ensure it uses resources efficiently and effectively.
Continue reading "Assessing the Adequacy of Risk Management" »
.jpg)
.jpg)
.jpg)
.jpg)
.jpg)
.jpg)