Friday Flashcards

Question

IRM risk culture definition

Answer 1

‘values, beliefs, knowledge and understanding about risk share by a group of people with a common purpose, in particular the employees of an organisation or of teams or groups within an organisation.’

Answer 2

1.Good communication of the orgs expectations of all staff - policies, presentations, staff newsletters, induction processses, job descriptions 2, convincing employees that they will personally benefit from good risk management practises 3. involvement in the risk ID process- gain buy in 4. training programmes that instil right practises and knowledge 5. investment in the use of effective IT security tools and activite and transparent monitoring of IT usage made clear to all employees

Answer 3

scientific method of determining human personality characteristics is called personality profiling, which can help: individuals explore their core personality, work preferences and strengths. It also helps them understand how others might perceive them, how they work with others how they may need to adapt those characteristics to suit their business environment and in different crisis situations.

Answer 4

illustrates personal predisposition at the centre of the risk cuulture then it interacts with personal ethics then behaviour and how org culture can affect risk culture IRM defined a risk culture framework to analyse, plan and act to influence risk culture within any organisation

Answer 5

1. personal predisposition, personal perception of risk. spontenous or cautious traits measured using personality assessment tools - risk type compass. 2. personal ethics. ethics profile of staff. every individual how own morals which impact decisions measured using moral DNA to consider which 3 ethical conscience they have result in ethic of obedience, care or reason 3. behaviours 4. org culture individual values, beliefs and attitudes towards risk contribute to and are affected by the wider overall culture of the org double s model considers sociability - people focus how people get on social solidarity - task focus - goal orientation and team performance 5. risk culture

Answer 6

How people perceive risk- objectively and subjectively risk has an objective reality - it will rain tomorrow or not and a subjective reality - human perception of the risk shaped by psycological, cultural factors and other - leading to people to under/over state the serverity of risk

Answer 7

Misperception of risk results in incorrect or inconsistent data being collected to fully assess or correctly treat risks -different perceptions of risk (ID) - people might hide risks or present false risks for their own self-interest (ID) -different views of likelihood risk occuring (analyis) -different knowledge of the way & level in which the risk can impact (analysis) -deliberate over/understate risk severity for self-interest (analysis) -different view of an acceptable level of risk to accept (evaluation) misperce

Answer 8

1.Leadership- strong leadership within org 2. Involvement - involvement of all stakeholders in all stages 3.Learning - emphasis on training in RM and learning from events 4,Accountability- no blame culture, appropriate accountability for actions 5.Communication - openess and communication on all RM issues and lessons learn

Answer 9

Risk attitude- chosen position adopted by an individual or group towards risk influence by risk perception Behaviour- external observable risk related actions of an individual Culture - values beliefs knowledge and understanding about risk share by a group with common purpose

Answer 10

Socialbility - vertical axis - people focus - how well people interact socially Solidarity - horizontal axis - task focused - goals and team performance model suggests strong sociability encourages - cohesion, common purpose and working in interconnected enviornment strong soldarity ensures risk controls and actions are implemented effectively

Answer 11

high sociability/high solidarity - communal high sociability low solidarity - networked high solidarity/ low sociability - mercenary low sociability/low solidarity - fragmented

Answer 12

FRC - complying with external stakeholder expectations guidance for premium listed companies on UK stock exhcange boards responsibility - determining to nature and extend of principle risks faced and those risk which the org is willing to take to achieve its strategic objevtives - risk appetite annual review for an org should review effectiveness of RM and internal control and the companys willingness to take on risks - risk appetite notes for board to consider - how has the board agreed the companys risk appetite and whom has it conferred

Answer 13

a full range of risks that could impact either positively or negatively on the ability of the org to achieve its long term objectives

Answer 14

needs to be measurable not a single fixed concept should be developed in the context of an orgs risk management capability risk appetite should take into account differing views at strategic tactical and operational level

Answer 15

the range between the risk appetite and risk capacity is risk tolerance area where risks can be tolerated for a certain amount of time whilst RM is working on bringing those risks to an acceptable level can be expressed in terms of absolutes e.g we will not expose more than x% of capital to losess in a certain line of business we will not deal with certain types of cumstomer 'deviation from the expected level of risk leading to implementation of risk escalation procedures' IRM - 'the boundaries of risk taking outside of which the org is not prepared to venture in persuit of its long term objectives

Answer 16

maximum level of risk the org should be exposed to in regard to financial and other resources

Answer 17

The amount of risk an org is willing to seek or accept in persuit of long term objectives- IRM two terms associated with this risks they are willing to seek and risks they are willing to accept

Answer 18

1. acknowledging interconnectivness - what is acceptable in one business unit may be out of appetite in another. There should be a way of dealing with this complexity 2. Measurability - use of KRI and KCI based on data from inside or out on org is needed to apply risk appetite consistently and realiscally. 3. variability - risks may be assessed consistently and scored against similar matrixes there will be a range of appetites for different risks 4. maturtiy - how adept an org is at managing risk will affect risk appetite. confidence of RM maturity should not be misplaced - maybe external validation?

Answer 19

reduce uncertainty improving consistency across governance and decision making focus on priority areas improved on resource prioritisation

Answer 20

The effect of UNCERTAINTY on objectives. The effect is a deviation from the expected. Positive or negative or both.

Answer 21

Financial 1. increased PROFIT 2. improved FINANCIAL REPORTING 3. enhanced CORPERATE GOVERNANCE 4. REDUCED COST of funding and capital 5. better control of CAPEX approvals Infastructure 1. Improved STAFF and SUPPLIER morale 2. targeted risk and COST REDUCTION 3. efficiency and COMPETITIVE advantage 4. RESILIANCE Reputational 1. REGULATORS satisfied 2. Improved utilisation of company BRAND 3. Enhanced SHAREHOLDER value 4. Good reputation and publicity 5. Improved perception of org Marketplace 1. COMMERICAL opportunities maximised 2. better MARKETPLACE presence 3. increased CUSTOMER SPEND and satisfaction 4. Higher rate of business successes 5. Low rate of business disasters

Answer 22

1. Provides guidelines in managing risks 2. follows a common approach 2. covers the entire lifecycle of org RM 3. applied at all levels and functions 4. Decision making

Answer 23

provides assurance orgs are directed and controlled in a way that ensures success and sustainability to protect shareholder and internal/external stakeholders interests (1992 first governance code) Cadbury 20224 corperate governance code only applies to companies listed on LDN stock exchange but used widely

Answer 24

1. leadership headed by an effective entrepenurial board collectively responsible for the long term success of the company 2. division of responsibilities clear devision if responsibilities between leadership of the board and executive leadership of the companys business 3. composition, succession and evaluation board and comittess should have a combo of skills exp and knowledge. annual evaluation of its composition,diversity and how effectively members work together yo achieve objectives. 4. audit risk and internal control board should establish procedures to maange, oversee international control framework and determine the nature and extent of the princple risks the company is willing to take to achieve strategic objevtives 5. remmuneration anything which mentioned remuneration

Answer 25

Principle O Board should establish and maintain effective risk management and internal control framework determine the nature and extent of principle risks the company will take to achieve long term strategic objectives The Code defines principal risks noting that they ‘should include, but are not necessarily limited to, those that could result in events or circumstances that might threaten the company’s business model, future performance, solvency or liquidity and reputation the board should also consider principal risks that offer singnicant improvement to the business model, future performance, solvency, liquidity and reptuation

Answer 26

wanted requirements often refered to as principles orgs are expected to comply with principles set out but not mandatory to do so if they do not comply they must explain why UK- principles based compulsary requirements often known as prescriptive based org must comply this these principles or penalty for non compliance this is refered to as 'comply and sign' US - prescriptive based

Answer 27

-companies avides to avoid tick box approach -operate comply or explain or principles based regime. -code not legal requirement however listed companies required to publish their annual report and accounts where they might not be complying with the code, together with reason why they are not complying -allows shareholders and interested parties to judge the materiality or importance of non complaicne

Answer 28

-comply and sign -installed into law with penalities for non complaicne for directors of publicly listed orgs - Sarbanes oxley following Enron and Worldcom scandals approach provides org with clarity in terms of compliance and a set of rules for all listed orgs often felt this approach can lead to more box ticking to avoid law and penalties

Answer 29

G20/OECD principles of corp governance (OEDCD 2015) used in many countires around world. not mandatory France - french commercial code., not mandatory. (AFEP/MEDEV) Germany - Germance governance code (GCGC) 2019. not legally binding US - sarbanes oxley act 2002 South africa King IV - apply and explain.

Answer 30

Non executive directors are not employees of the org and not involved in day to day running 'non exec directors provide creative contribution to the board by providing independant oversight and constructive challenge to exec directors' independant good practice- more NEDS on board than executive directors. bring perspective and experience

Answer 31

Unitary - Execs and non execs serve together on one board - UK,US, AUS, SA Two-tier - Responsibility for supervision (non execs) is seperated from the responsibility of day to day (the exec) the op board oversees managerial tasks and transactions supervistory board general manages long term strategic planning and decision making and oversees operation board. - europe.

Answer 32

Although execs have more control over the appointment of NEDS, members are appointed on their expertees, CEO is prevented as serving as chair of sopervisory board - reduction in bias in decision making process main disadvantage is that two tiered boards tend to be larger than unitary boards

Answer 33

advantages board receives more detailed info greater involved in the org and is closer to organisational strategy. disadvantage external perspective there is little distinction between management and supervision conflict of interest and loss of independence may develop

Answer 34

Most boards delegate work through comittees Nominaton: appointment of new directors ensuring succession plans are in place for the board and executive level immedietly below it Remuneration setting executive pay Audit orgs financial reporting reviewing effectiveness of internal control & RM whistle blowing, following up on issues of bad conduct

Answer 35

Nomination Remuneration Aduit Operations Sustainability, Finance Members Risk appetite Strategy Emerging risks outcomes of stress testting nad internal control appropriateness of value,culture and reward

Answer 36

Serve the public interest by setting high standards of corp governnace, reporting and audit independant fair effective originated 1980s 2004 - audit accountancy regs 2011independant entity

Answer 37

response to enron, worldcom and global crossing scandals EST 2006 Comply and sign SOX requires a recognised RM framework to be implemented and recomended COSO. 302 - CEO and CFO directly responsible for accuracy, docs and submission of all financial reports and internal control structure 404 - annual financial reports must report that management are responsible for adequate internal control structure and an assessment by management of the effectiveness of the structure with weakenesses being reported - registered external audtors must attest to the accuracy of managers declaration.

Answer 38

not- for - profit org that provides policies and standards for governments, parliments, international orgs Guidlines for state owned enterprises to give advice to COUNTIRES on how to manage their responsibilties EST 2005, updated 2015 updated in 2023. 3 fold approach 1.provide knowledge and advice to inform policies and steer decision making 2.to engage and influene policy makers to enable ideas and exp to be shared 3. encourage countries and partners to develop international standards to enable a consistent approach to reach shared objectives

Answer 39

Determine strategic approach to risk establish structure for RM understand most critical risks consider the risk implications of poor decisions manage org in crisis

Answer 40

build risk aware culture within the location agree risk management performance for location evaluate reports from employeees on RM matters ensure implementatiion of risk improvement recomendations identify and report changed circumstances/risks

Answer 41

Understand, accept and implement RM proceses report inefficient, unceesary or bad controls report loss events & near miss incidents cooperate with management on incident investigations ensure that visitors & contractors comply with procedures

Answer 42

develop the RM policy and keep up to date responsible for developing the RASP faciliate risk aware culture within org establish internal control policies and structures coordinate rm activties complile risk information and prepare reports for the board corperate learning - so people are aware of benefits of RM

Answer 43

assist company in establishing specialist risk policies develop specialist contingency and recovery plans up to date in specialist areas support investigstions of incidents and near misses (same as individual employees) preare reports on specialist risks

Answer 44

develop audit based internal audit programme audit risk processes across org provide assurance on management of risk support and help develop the RM processess report on efficiency and effectiveness of internal controls

Answer 45

consolidated the common law duties of directors and codified general duteus: act in accordance of allocated duties act in accordance with the constitution of the company promote the success of the compant exercise independant judgement exercise reasonable care, skill & diligence avoid/declar conflict of interests do not accept benefits from third parties

Answer 46

assisgt with formation of strategy & monitor performance role on nled: strategy: constructively challenge & help develop proposals on strategy Performance: scrutinize performance of managment Risk: challenge the integrity of financial info Controls: seek assurance that financial controls & system of RM are robust & defensive People: determine appropraite level of remmuneration/ succession planning confidence: seek to establish & maintain confidence in the CONDUCT of company independence: in judgement and promote openeness & trust knowledge: be well informed about company & external enviornment and strong commnand of relevant issues

Answer 47

-Champion of the ERM process -Bringing together different RM processes tailored for different requirements to form COHESIVE view - working with other to establish effective mgement of risk, monitor progress & assist in reporting relevant RI most senior exec with responsibility & accountability for RM process. Responsibilies: Insiight & context - use knowledge of internal & external influences to ensur robust RM in responsive and agile orgs Strategy and performance - develop a rm strategy to meet org needs risk management process - managing RM process ORG capability - developing & managing a skilled, agile & responsive risk org

Answer 48

IIA - independent objecvtive assurance and consulting activity designed to add value and improve orgs operations 1.evaluating orgs management of risks 2.enhances the effeciveness and efficiency of the business 3. assessing management of risk & assisting in management of improving internal controls 4. remain indepedence from operatinoal management internal audit reports direcrtly to chair of audit comittee audit comittee may sit in finance team - head of internal audiy may report to finance director

Answer 49

REVIEWING management of key risks EVALUATING the reporting of key risks EVALUATING rm process GIVING ASSURANCE risks are correctly evaluated GIVING assurance on RM process roles with safeguards facilitating ID & evaluation of risks coaching management in responding to risks co-ordinating ERM activties consolidated ERM activies consolidated reporting on risks maintaining and developing ERM framework championing establishment of ERM developing RM strategy for board approval

Answer 50

statistical sampling techniques, risk prioritisation techniques assurance mapping.

Answer 51

Going concern - Viable future - for next 12 months longer term viability statement - reasonable expectation - they will be ablev to continue in operation & meet liabilities - significantly longer than q12 months from approval of financial statements

Answer 52

roles responsibilities communication and risk reporting structure

Answer 53

risk strategy appetite attitudes phiosolophy

Answer 54

defined in risk guidlines for the org rules and procedures rm methedologies tools and techniques that should be used

Answer 55

8 prinicipels 1.customised proportionate 2. stakeholder involvement 3. structured compherehesive approach 4. rm integral part of all org activites 5. anctipates,detects, acknolowedges and responds to change 6. limitations of available info 7. human and cultural 8. continual improvement

Answer 56

ERM should be embedded into activties of an org - including: mission vision and core values strategy development business objevtive formulation implementagtion and performance ehanced value

Answer 57

1. Governance and culture sets tone establishes oversight responsibiltiies culture relates to ethical values, desired behaviours and understanding of risk 2. Strategy and objective setting ERM, strategy & objective setting work together in the strategic planning process risk appetite - alligned with stategy and business objectives 3. Performance risks that can impact achievement of strategy and business objectives. identify, assess, prioritise by severity in conext of risk appetite, so risks responses can be selected 4. Review & revision reviewing entity performance org can consider ERM effectiveness 5. Informatiotion, communication and reporting continual process of obtaining and sharing neccessary info both internal/enteral.

Answer 58

Financial reduced cost of FUNDING and CAPITAL enhanced corperate governance accurate financial risk reporting increasred profitability better control of capex approvals Infastructure efficiency & competitive advantage resiliance improved supplier & staff morale targeted risk & cost reduction reduced OPERATIONAL COSTS Reputational regulators satisfied imrpoved company brand enhancecd shareholder value good reputation and publicity improved perception of org Marketplace commercial opportunities maximised better marketplace presence increased customer spend & satisfaction high ratio of business successses low ratio of business disasters

Friday Flashcards

Context, Objectives, and Risk Assessment (82 cards)