Module 1 Flashcards
Principles of Risk and Risk Management ERM - (39 cards)
ISO 31000 (2018) definition of risk
The effect of UNCERTAINTY on objectives. The effect is a deviation from the expected. Positive or negative or both.
IRM definition of risk
Risk is the COMBINATION of the probability of an event and its CONSEQUENCE. consequence can range from positive to negative
Four categories of risk
Hazard - Negative
Opportunity - Positive
Control - Uncertainty
Compliance - Mandatory
ISO 31000 risk management definition
COORDINATED activities to direct and control an organisation with regard to risk
Aspect of ERM approach
1.Risk in the context of business strategy
2. Risk portfolio development with 3. risk interconnectivities
4. Focus on critical risks
5. Risk is entity wide
7. identifying and defining risk responsibilities
6.Monitoring and measuring risk
7.Risk is embedded into everyone’s responsibility
Aspects of traditional RM approach
- Focus on risk identification and analysis
- Risk individual hazards
- Focus on all risks managed in separate areas
- risk mitigation
- risk with no owners
- risk is insurance
- risk is not my responsibility
COSO ERM Framework (2017) defines ERM as
The CULTURE,CAPABILITIES AND PRACTISES integrated with strategy-setting and its execution that orgs rely on to manage risk in creating, preserving and realising value.
IRM risk management definition
Process which aims to help orgs understand, evaluate and take action on their risks with the view of increasing PROBABILITY of success and reducing the LIKELIHOOD of failure
HM treasury risk management definition
THE co-ordinated activities designed and operated to manage risk and exercise INTERNAL CONTROL within an org
Features of an ERM approach
- Encompasses all areas of org exposure to risk
- Prioritises and manages exposures as an interrelated risk portfolilo rather than in Silos
- evaluates the risk portfolio in context of all significant internal and external contexts, systems, circumstances and stakeholders
- Recognises individual risks across the org are interrelated and can create a combined exposure that differs from the sum on individual risks
- provides structured approach to RM regardless if risks are qualitative and quantitative in nature
- Seeks to embedd RM as a component for all critical decisions throughout the ORG.
- Provides the means for ORG to identify the risks it is willing to take in order to achieve strategic objectives
- CONTSTRUCTS MEANS OF COMMUNICATING on risk issues so there is a common understanding of the risks faced by the org and their importance.
- SUPPORTS ACTIVTIES OF INTERNAL AUDIT by providing a structure for the provision of assurance to the board and audit comittee
- views the effective management of risk as a COMPETITIVE ADVANTAGE that contributes to the achievement of business and strategic objectives
Orange book definition of ERM
The co-ordinated activites designed and operated to manage risk and exercise internal control within an org
IIA definition of ERM
A RIGOROUS and co-ordinated approach to assessing and responding to all risks that effect the achievement of an orgs strategic and financial objectives
RIMS definition of ERM
ERM is a strategic business discipline that supports the achievement of the orgs objectives by addressing the FULL SPECTRUM of its risk and managing the combined impact of those as an interrelated risk portfolio
Benefits of ERM
Financial
1. increased PROFIT
2. improved FINANCIAL REPORTING
3. enhanced CORPERATE GOVERNANCE
4. REDUCED COST of funding and capital
5. better control of CAPEX approvals
Infastructure
1. Improved STAFF and SUPPLIER morale
2. targeted risk and COST REDUCTION
3. efficiency and COMPETITIVE advantage
4. RESILIANCE
Reputational
1. REGULATORS satisfied
2. Improved utilisation of company BRAND
3. Enhanced SHAREHOLDER value
4. Good reputation and publicity
5. Improved perception of org
Marketplace
1. COMMERICAL opportunities maximised
2. better MARKETPLACE presence
3. increased CUSTOMER SPEND and satisfaction
4. Higher rate of business successes
5. Low rate of business disasters
SCOPE of ISO 31000
- Provides guidelines in managing risks
- follows a common approach
- covers the entire lifecycle of org RM
- applied at all levels and functions
- Decision making
ISO Principles
INTEGRATED
Risk management in an integral part of all org activities
STRUCTURED AND COMPREHENSIVE
This contributes to consistent and comparable results
CUSTOMISED
The RM framework and processesare customised and proportianate to the orgs external and internal context related to its objectives
INCLUSIVE
appropriate and timely involvement of stakeholders enables their knowledge an d views to be considered. Improves awareness and informed RM.
DYNAMIC
RM anticipates, detects, acknlowedges and responds to those changes and events in appropriate timely manner
BEST AVAILABLE INFO
Risk management explicity takes into account any limitations and uncertainties associated with information and expectations.
HUMAN AND CULTURAL FACTORS
human behaviour and culture significantly influences all aspect of RM at each level and stage
CONTINUAL IMPROVEMENT
RM is continually improved through learning and experience.
ISO 31000 RM Framework
Centre - Leadership and comittment
Design DO
Implementation I
Evaluation EVER
Improvement Inhale
Integration Ice cream
RM History
1500: Religious belief, fate and superstition – evolutionary theory.
1500 – 1900: A decline of the above by educational enlightenment in risk.
1900 – 1970: Development of specialist risk professions.
1970 – 95: Risk management specialism moves towards generalism.
1995 – date: The maturing risk profession.
1995 – 2004: The introduction of risk management standards.
2004 – 2018: International frameworks and standards developed and updated, such as COSO ERM Frameworks and ISO 31000.
2010 - date: Prominence of climate change and ESG rises – CSR, sustainability and resilience become core risk management conversations.
Chapman (2011) Benefits of ERM - Strategy, Governance, Operational performance and People
STRATEGY
Build confidence in stakeholders and the investment community
Allign risk appetite and strategy
Link grown risk and return
GOVERNANCE
Comply with relevant legal and regulatory requirements
Enhance corporate governance
embedd of the risk process throughout the org
Rationalise capital
ORGANISATIONAL PERFORMANCE
^ likelihood of realising business objectives
^ organisational resiliance
Embedd RM process throughout the org
Minimise operational surprises and losses
enhance risk response decisions
identfy and manage cross enterprise risks
PEOPLE
Optimise allocation of resources
improve org learning
Why risk informed decision making matters (2019)
States that risk informed strategy should be a priority
With the C suit expecting ERM to play an ^ role in setting and implementing the orgs strategy
UK’s corporate governance institute (CGI) defines governance as
the system of RULES, PRACTISES AND PROCESSES by which a company is directed and controlled
EY board priorities 2022 - considers boards should focus attention on fast evolving business enviorment at the same time as monitoring emering risks rather than limiting their audit focus on financial reporting
Why understanding risk is important - STOC
STRATEGY
risk assocaited with strategic options better analysed = better decision making
TACTICS
consideration to selection of tactics and assocaited risks involved and available alternatives evaluated
OPERATIONS
events which cause disruption will be identified in advance and action take to reduce likelihood of occuring and damage
COMPLIENCE
risks assocaited with failure to achieve compliance will be adressed
Specialist areas of RM
project
medical/clinical
energy rm
financial
IT
information securtiy
B continuity
H&S
DR planning
4 T’s of Hazard risks
Tolerate
Treat
Transfer
Terminate
