Chapter 16 - Enterprise Risk Management Flashcards
(97 cards)
1
Q
Enterprise Risk Management
A
Comprehensive, organization-wide approach to identifying, measuring, and managing various risks
2
Q
The CRO position is usually accountable to which of two potential parties?
A
The CEO
The Board
3
Q
7 Steps to the Risk Management Process
A
Determine the organization’s risk tolerance/appetite
Identify potential exposures
Quantify each exposure
Compare current levels or risk to the target level of risk
Develop and implement an appropriate risk management strategy to manage the differences between the two
Monitor the exposures and evaluate the effectiveness of the strategy
Review and modify the strategy as needed
4
Q
What are some items that may limit a company’s ability to accept risks?
A
Covenants or indentures in agreements or charters
5
Q
When identifying potential risk exposures, what are the three factors that should be considered?
A
Likelihood
Potential impact
Velocity (speed at which the risk would materialize)
6
Q
Risk Profile
A
How the company’s overall value changes as financial variables change
7
Q
Risk Self-Assessment Steps
A
Identify the risks
Classifies each risk into clearly defined categories
Quantifies the risks with respect to the probability of occurrence
8
Q
Are risk self-assessments required in some instances?
A
Yes, required by SOX
9
Q
Risk and Control Self-Assessments (RCSAs)
A
Risk assessments that are tested regularly
10
Q
The materiality of the risk exposure will drive which two items as it relates to monitoring?
A
Frequency and amount of monitoring and testing
11
Q
Developing a cost-versus-benefit framework would be a qualitative or quantitative method of quantifying a risk?
A
Quantitative
12
Q
Residual Risk
A
Inherent risk less any risk management strategies
13
Q
Four Essential Risk Management Approaches
A
Retain the Risk
Avoid the Risk
Mitigate the Risk
Transfer the Risk
14
Q
Retain the Risk Examples
A
Utility company operating in areas prone to hurricanes
15
Q
Mitigate the Risk Examples
A
Balance sheet hedging
Supplier diversification
Process and facility design
Project management
Education
Compliance management
16
Q
What is the primary means of transferring risk?
A
Insurance
17
Q
A joint-venture would be an example of doing what with risk?
A
Retaining some and transferring a portion
18
Q
How can risk be monitored effectively?
A
Assign ownership over each exposure
19
Q
Internal Control
(COSO Definition)
A
Process designed to provide reasonable assurance regarding the achievement of objectives across:
* Effectiveness or efficiency of operations
* Reliability of financial reporting
* Compliance with laws and regulations
20
Q
What is an important thing to remember for internal controls in the risk management process?
(this is one of the most common issues with internal controls)
A
They need to be well-documented as this is a recurring issue for many companies
21
Q
Risk Management Oversight involves which key factors?
A
- Organizational Culture
- Internal Controls
- Technology
- Guidelines for Board of Directors
22
Q
Market Risk and 4 Components
A
Fluctuations in rates and prices will reduce the value of a security or portfolio
4 Components
* Equity Price Risk
* Interest Rate Risk
* FX Risk
* Commodity Price Risk
23
Q
Financial Risk
(which risks are categorized under financial risk?)
A
Impact on an organization from changes in:
* Interest rates
* FX
* Commodity pricing
24
Q
Natural Hedging
A
Risk mitigation through the organization’s ongoing day-to-day transactions
25
Financial Risk can be focused on individual XXXXXX and the overall XXXXXX of the firm
Transactions
Market value
26
ERM Heat Map
Way of visually presenting identified exposures for Probability, Impact, and Velocity of risks
27
Equity Price Risk
Risk associated with volatility in stock prices
28
XXXXXXX risk can be mitigated by holding a portfolio stocks, while XXXXX cannot be eliminated
Firm-specific
General risk
29
How does equity risk primarily impact treasurers?
Influence a company’s ability to raise capital in equity and bond markets
30
Why can price volatility be magnified for commodities?
Suppliers are usually concentrated
31
Recovery Value or Rate
Creditor may recover some value after default
32
Loss Given Default
Percentage of Recovery Value or Rate
33
Operational Risk
Losses resulting from inadequate systems, management failure, faulty controls, fraud and human error, etc.
34
Two Areas of Liquidity Risk
Funding Liquidity Risk
Asset Liquidity Risk
35
Funding Liquidity Risk
Organization’s ability to raise the necessary cash to meet its obligations as they come due
Ability to raise short-term and long-term capital in a timely manner
Use marketable securities or available lines of credit
36
Asset Liquidity Risk
Ability to sell an asset quickly and at, or close to, its true value
37
Event Risk
Risk associated with unexpected events
38
Strategic Risk
Risk associated with execution of a strategy that may not be successful and profitable
39
Business Risk
Day-to-day risks associated with strategic risk
40
Reputation Risk
Risk that customers, suppliers, investors, and/or regulator may not want to do business with a firm
Heavily influenced by social media, so it should be restricted
41
Sources of Cyber Threats
| (review)
Current and former employees
Denial-of-Service (DoS) attack
Breaches or compromises of electronic databases by computer hackers or other sources
Intellectual property theft
Financial criminals
Activists
Corporate identity theft or account takeover
42
When a company outsources activity to a third party, the scope of cyber risk does what?
Increases
43
Internal Operational Risks
Employee Risk
Process Risk
Technology Risk
44
What is usually the significant source of internal risk stemming from employees related to?
Employee errors in data entry
Lack of knowledge or skills
Loss of key employees
45
Defalcation Risk
Intentional employee fraud
46
Fidelity Risk
Defalcation risk specific to money, securities, or property
47
Process Risk
| (and what does it usually stem from?)
Losses related to the processes employed in day-to-day business operations
Usually comes from a lack of proper controls or the failure of employes to follow procedures due to a lack of training
48
Examples of Process Risk
| (review)
Accounting or financial reporting errors
Lack of timely reconciliation of bank accounts
Calculation risk
Nonpayment for goods/services
Errors in clearing and settlement processes for financial transactions
Processes are overly complex
Personal data protection and management
May not meet terms of contracts with customers and suppliers
49
Security Violations
| (what are these and are they internal or external?)
Internal security breaches
50
Examples of Technology Risk
| (review)
Third party data access and storage
Choice of technology platform or vendor
Obsolescence of technology
Capabilities, capacity, compatibility of technology
Overuse of spreadsheets
51
External Operational Risks
* Financial Institution Risk
* Counterparty Risk
* Legal and Regulatory Compliance Risk
* Sovereign and Political Risk (two parts)
* Supplier Risk
* External Theft/Fraud Risk
* Physical and Electronic Security Risk
* Event Risk
**Financial Institution Risk** – failure of the financial institution; use of online banking portal, payments and payment files
**Counterparty Risk** – other party in a contract or financial transaction will not perform as promised; credit and default risk
**Legal and Regulatory Compliance Risk** – potential lawsuits or other legal actions
**Sovereign and Political Risk**
* Sovereign Risk – government will default on debt
* Political Risk – economic impact that businesses may face due to government changes or decisions within a country
**Supplier Risk** – supplier or outsourced service will not meet contractual requirements
**External Theft/Fraud Risk** – typically focused on payment process; malfeasance involving collusion; robbery or theft of physical cash at retail locations
**Physical and Electronic Security Risk** – physical security to control access to premises and electronic data
**Event Risk** – effects of natural disasters, terrorism, etc.
52
Supplier risk is a crucial risk to monitor when what is employed by a firm?
Just-in-time inventory
53
The Risk Management Policy should do the following:
| (review)
* Contain a concise statement of the risk management goals and overall scope
* Define authorities and responsibilities as well as the role of the CRO
* Identify the types of exposures to be managed
* Delineate the mitigation techniques and products that may be used
* Outline the process for determining specific strategies to be employed and exposures to be mitigated
* Summarize the process for monitoring performance of the strategies
* Outline contingency plans
* Require periodic review of the policy and testing of plans
54
Is speculation a treasury objective?
No
| This will likely be an incorrect answer
55
What type of risk is a combination of counterparty and operational risk?
Supplier Risk
56
Which actions are usually considered the most significant source of internal risk?
Data entry errors
57
Value at Risk (VaR)
| (remember key term of what the VaR boils down to)
**One single measure** that answers the question what is the maximum loss that can be expected over a given period of time?
58
What is a potential risk of using the VaR model?
It is reliant upon historical data and it will not necessarily capture any new relationships between variables.
59
CaR vs. VaR
CaR was developed to allow corporations that don’t have liquid assets to assess impacts on cash flows
60
Benefit of the Results presented in CaR
Easy for nonfinancial specialists in strategic roles to understand
61
Can VaR or CaR provide the maximum amount of a loss?
No, all based on standard deviations
62
Four Objectives in Insurance Management
Insure against catastrophic loss
Decide when and what to insure (while complying with laws)
Manage the purchase and use of insurance
Obtain efficient pricing for insurance needs
63
What is the cost of risk from losses calculated as?
Total actual and potential losses
64
Independent Insurance Agent vs. Broker Agency
Independent Insurance Agent = agent of insurance company
Broker = agency of client
65
Key things to consider for insurance provider
| (review)
Long-Term Solvency of the Insurer
Rating for the Insurer
Service Provided
Cost versus Exposure
Industry knowledge and experience
66
What is one way a firm’s lenders can influence the quality of insurance provided to minimize risk?
Set minimum credit ratings for insurers
67
How are insurers rated from a credit ratings perspective?
| (are the ratings provided independent or dependent on one another?)
AM Best Company provides two ratings
* Financial strength
* Indebtedness
| Ratings are INDEPENDENT
68
Total Cost of Risk (TCOR) for Insurance
Cost of insurance
Cost of losses ***that are retained***
Administrative costs associated with the firm’s risk management program
69
Deductibles are also known as what?
Retentions
Excess
70
Cost of First-Dollar Coverage
Insurance coverage with no deductible
Will be very expensive
71
Deductible may be set on a combination of which two approaches?
Per-occurrence basis
Aggregate basis
72
Date of Occurrence vs. Claims Made
**Date of Occurrence** – focuses on when the loss actually occurred and must align the coverage period in the policy
**Claims Made** – focuses on when the claim is made and which policy is in force at the time
73
What do Insurance Risk Management Services do?
Can help to supplement in-house expertise if it exists in the company
74
Risk Financing
Involves resources that an organization may drawn upon to finance recovery from losses and liabilities
75
Two approaches to risk financing
Risk Retention
Risk Transferring
76
Risk Retention Approaches to Risk Financing
* Noninsurance
* Self-Insurance
* Single-Parent Captive
* Group Captive
* Risk Retention Group
* Claims Management
**Noninsurance** – no insurance is purchased
**Self-Insurance** – company sets aside funds for loss payouts; may purchase excess
**Single-Parent Captive** – subsidiary is created to insure parent; can provide tax benefits and policy efficiencies
**Group Captive** – similar to single-parent captive but with multiple parent entities
**Risk Retention Group** – specific group captive where multiple organizations in an industry may share similar liability risks; formed under US federal law
**Claims Management** – companies may outsource claims processing to a third party to reduce costs
77
What is the difference between noninsurance and self-insurance?
In self-insurance, the organization is making a conscious choice to allocate funds to loss financing
78
Risk Retention Group
| (and examples)
A group captive formed under the terms of a US federal law that enable businesses that share similar risks to work together to jointly finance liability claims
Must only be liability claims
Examples include airline industry, professional occupations, etc.
79
Risk Transfer Approaches to Risk Financing
* Contractual Transfer
* Guaranteed Cost Insurance Program
* Retro Rated Insurance Program
**Contractual Transfer** – hold-harmless agreement to transfer to a non-insurer
**Guaranteed Cost Insurance Program** – pay premium annually, may not be eligible for premium refund if cancelled during the year
**Retro Rated Insurance Program** – pay a premium that is adjusted later; very common for worker’s compensation
80
Hold Harmless agreements are common in which method of risk financing?
Contractual transfer
81
Subrogation
Recovering loss from other parties
82
Reinsurance
A system where insurance companies transfer part of their risk to another company, called a reinsurer, to reduce the chance of large financial losses from claims
83
What does coinsurance mean in each of these three contexts:
* US Property Insurance
* US Health Insurance
* Reinsurance
**US Property Insurance** – insured much purchase an amount equal to or greater than a specified proportion of the value of the insured property
**US Health Insurance** – insured must pay a proportion of any health care costs
**Reinsurance** – coinsurance is synonymous with reinsurance
84
Which technique to measure risk involves asking employees to come up with best and worst case scenarios and sometimes having them come up with subjective probabilities?
Scenario Analysis
Monte Carlo requires standard probability distributions and random numbers
85
Which one is more expensive for premium pricing: per-occurrence deductible or aggregate deductible?
Aggregate deductible because it limits insured’s exposure if there are multiple events of loss in the same period
86
Disaster Recovery vs. Business Continuity
**Disaster Recovery** – restoration of systems and communications after an event causes an outage
**Business Continuity** – actions taken with regard to crisis management, alternative operating procedures, and communications
87
What is the intent of disaster avoidance, recovery, and remediation measures?
Preserve the firm’s revenue stream
88
What is the primary focus area for disaster recovery and business continuity plans?
Business supply chain
Financial supply chain (Procure-to-Pay)
89
Financial Supply Chain Internal and External Parties
Internal – treasury, computer systems, policies, procedures, processes, office facilities
External – financial institutions, market information, vendors, financial markets
90
Steps in Developing Effective DR/BC Plans
1. Identify Mission-Critical Functions
2. Assess Risks
3. Evaluate Contingency Measures
4. Prioritize Corrective Action
5. Create a Communication Plan
91
How often should DR/BC Plans be tested?
At least annually, preferably semiannually
Should also sometimes occur without warning
92
Account Takeover
Hacker gains access to a company’s bank account information and uses that information to remove funds from the account
93
What are the two primary functions of performing periodic testing of DR/BC plans?
Identify problems with the plan that need to be corrected
Train employees and ingrain appropriate emergency responses
94
Do government guaranteed funds provide a material level of protection when an insurer fails?
No, they only provide limited protection
95
AM Best Company provides ratings on financial strength and on indebtedness of insurance providers. Are these ratings dependent on one another?
No, they are independent opinions
96
If a company wants to summarize the potential impacts of something in a single measure, which option is best:
A. Sensitivity Analysis
B. VaR
C. Scenario Analysis
D. Monte Carlo
VaR was designed to incorporate wide range of risk factors and summarize their impact in a single measure
97
Quantitative Assessment for Measuring Exposure on Risks
| (review)
Assess the materiality or level of the exposure
Determine the probability or likelihood
Assess the estimated timing and velocity
Identify the risk drivers or factors that cause the risk to materialize
Provide a benchmark for assessing risk mitigation strategies
