全面風(fēng)險(xiǎn)管理框架英文

全面風(fēng)險(xiǎn)管理框架英文Today’sorganizationsareconcernedabout:RiskManagementGovernanceControlAssurance(andConsulting)ERMDefined:“…aprocess,effectedbyanentity'sboardofdirectors,managementandotherpersonnel,appliedinstrategysettingandacrosstheenterprise,designedtoidentifypotentialeventsthatmayaffecttheentity,andmanageriskstobewithinitsriskappetite,toprovidereasonableassuranceregardingtheachievementofentityobjectives.”Source:COSOEnterpriseRiskManagement–IntegratedFramework.2004.COSO.WhyERMIsImportantUnderlyingprinciples:

Everyentity,whetherfor-profit

ornot,existstorealizevaluefor

itsstakeholders.Valueiscreated,preserved,orerodedbymanagementdecisionsinallactivities,fromsettingstrategytooperatingtheenterpriseday-to-day.WhyERMIsImportantERMsupportsvaluecreationbyenablingmanagementto:

Dealeffectivelywithpotentialfutureeventsthatcreateuncertainty.Respondinamannerthatreducesthelikelihoodofdownsideoutcomesandincreasestheupside.ThisCOSOERMframeworkdefinesessentialcomponents,suggestsacommonlanguage,andprovidescleardirectionandguidanceforenterpriseriskmanagement.EnterpriseRiskManagement—IntegratedFrameworkTheERMFrameworkEntityobjectivescanbeviewedinthecontextoffourcategories:

StrategicOperationsReportingComplianceTheERMFrameworkERMconsidersactivitiesatalllevelsoftheorganization:Enterprise-levelDivisionor subsidiaryBusinessunit processesEnterpriseriskmanagement

requiresanentitytotakeaportfolioviewofrisk.

TheERMFrameworkManagementconsidershow

individualrisksinterrelate.Managementdevelopsaportfolioviewfromtwoperspectives:-Businessunitlevel-EntitylevelTheERMFrameworkTheeightcomponentsoftheframeworkareinterrelated…TheERMFrameworkInternalEnvironmentEstablishesaphilosophyregardingriskmanagement.Itrecognizesthatunexpectedaswellasexpectedeventsmayoccur.Establishestheentity’sriskculture.Considersallotheraspectsofhowtheorganization’sactionsmayaffectitsriskculture.

ObjectiveSettingIsappliedwhenmanagementconsidersrisksstrategyinthesettingofobjectives.Formstheriskappetiteoftheentity—ahigh-levelviewofhowmuchriskmanagementandtheboardarewillingtoaccept.Risktolerance,theacceptablelevelofvariationaroundobjectives,isalignedwithriskappetite.EventIdentificationDifferentiatesrisksandopportunities.Eventsthatmayhaveanegativeimpactrepresentrisks.Eventsthatmayhaveapositiveimpactrepresentnaturaloffsets(opportunities),whichmanagementchannelsbacktostrategysetting.

EventIdentificationInvolvesidentifyingthoseincidents,occurringinternallyorexternally,thatcouldaffectstrategyandachievementofobjectives.Addresseshowinternalandexternalfactorscombineandinteracttoinfluencetheriskprofile.

RiskAssessmentAllowsanentitytounderstandtheextenttowhichpotentialeventsmightimpactobjectives.Assessesrisksfromtwoperspectives: -Likelihood -Impact

Isusedtoassessrisksandisnormallyalsousedtomeasuretherelatedobjectives.RiskAssessmentEmploysacombinationofbothqualitativeandquantitativeriskassessmentmethodologies.Relatestimehorizonstoobjectivehorizons.Assessesriskonbothaninherentandaresidualbasis.RiskResponseIdentifiesandevaluatespossibleresponsestorisk.Evaluatesoptionsinrelationtoentity’sriskappetite,costvs.benefitofpotentialriskresponses,anddegreetowhicharesponsewillreduceimpactand/orlikelihood.Selectsandexecutesresponsebasedonevaluationoftheportfolioofrisksandresponses.ControlActivitiesPoliciesandproceduresthathelpensurethattheriskresponses,aswellasotherentitydirectives,arecarriedout.Occurthroughouttheorganization,atalllevelsandinallfunctions.Includeapplicationandgeneralinformationtechnologycontrols.Managementidentifies,captures,andcommunicatespertinentinformationinaformandtimeframethatenablespeopletocarryouttheirresponsibilities.

Communicationoccursinabroadersense,flowingdown,across,andup

theorganization.Information&CommunicationMonitoringEffectivenessoftheotherERMcomponentsismonitoredthrough:

Ongoingmonitoringactivities.

Separateevaluations.

Acombinationofthetwo.InternalControlAstrongsystemofinternalcontrolisessentialtoeffectiveenterpriseriskmanagement.

Expandsandelaboratesonelements

ofinternalcontrolassetoutinCOSO’s

“controlframework.”

Includesobjectivesettingasaseparatecomponent.Objectivesarea“prerequisite”forinternalcontrol.Expandsthecontrolframework’s“FinancialReporting”and“RiskAssessment.”RelationshiptoInternalControl—IntegratedFrameworkERMRoles&ResponsibilitiesManagement

Theboardofdirectors

Riskofficers

InternalauditorsInternalAuditorsPlayanimportantroleinmonitoringERM,butdoNOThaveprimaryresponsibilityforitsimplementation

ormaintenance.

Assistmanagementandtheboardorauditcommitteeintheprocessby: -Monitoring -Evaluating -Examining -Reporting-Recommendingimprovements

Visittheguidancesectionof

TheIIA’sWebsiteforTheIIA’s

positionpaper,“RoleofInternalAuditing’sinEnterpriseRiskManagement.”InternalAuditors2010.A1–Theinternalauditactivity’splanofengagementsshouldbebasedonariskassessment,undertakenatleastannually.

2120.A1–Basedontheresultsoftheriskassessment,theinternalauditactivityshouldevaluatetheadequacyandeffectivenessofcontrolsencompassingtheorganization’sgovernance,operations,andinformationsystems.2210.A1–Whenplanningtheengagement,theinternalauditorshouldidentifyandassessrisksrelevanttotheactivityunderreview.Theengagementobjectivesshouldreflecttheresultsoftheriskassessment.StandardsOrganizationaldesignofbusinessEstablishinganERMorganizationPerformingriskassessmentsDeterminingoverallriskappetiteIdentifyingriskresponsesCommunicationofriskresultsMonitoringOversight&periodicreview

bymanagementKeyImplementationFactorsOrganizationalDesignStrategiesofthebusinessKeybusinessobjectivesRelatedobjectivesthatcascade

downtheorganizationfromkeybusinessobjectivesAssignmentofresponsibilitiestoorganizationalelementsandleaders(linkage)Exle:LinkageMission–Toprovidehigh-qualityaccessibleandaffordablecommunity-basedhealthcare

StrategicObjective–Tobethefirst

orsecondlargest,full-servicehealth

careproviderinmid-sizemetropolitanmarkets

RelatedObjective–Toinitiate

dialoguewithleadershipof10topunder-performinghospitalsandnegotiateagreementswithtwothisyearEstablishERMDetermineariskphilosophy

Surveyriskculture

Considerorganizationalintegrity

andethicalvaluesDeciderolesandresponsibilitiesExle:ERMOrganizationERM

DirectorVicePresidentand

ChiefRiskOfficerCorporateCredit

RiskManagerInsurance

RiskManagerERM

ManagerERM

ManagerStaffStaffStaffFES

Commodity

RiskMg.DirectorRiskassessmentistheidentificationandanalysisofriskstotheachievementofbusinessobjectives.Itformsabasisfordetermininghowrisksshouldbemanaged.AssessRiskEnvironmentalRisksCapitalAvailabilityRegulatory,Political,andLegalFinancialMarketsandShareholderRelationsProcessRisksOperationsRiskEmpowermentRiskInformationProcessing/TechnologyRiskIntegrityRiskFinancialRiskInformationforDecisionMakingOperationalRiskFinancialRiskStrategicRiskExle:RiskModelSource:BusinessRiskAssessment.1998–TheInstituteofInternalAuditorsControlItShareorTransferItDiversifyorAvoidItRiskManagementProcessLevelActivityLevelEntityLevelRiskMonitoring

IdentificationMeasurementPrioritizationRiskAssessmentRiskAnalysis

DETERMINERISKAPPETITERiskappetiteistheamountofrisk—onabroadlevel—anentityiswillingtoacceptinpursuitofvalue.Usequantitativeorqualitativeterms(e.g.earningsatriskvs.reputationrisk),andconsiderrisktolerance(rangeofacceptablevariation).Keyquestions:Whatriskswilltheorganizationnotaccept?

(e.g.environmentalorqualitycompromises)

Whatriskswilltheorganizationtakeonnewinitiatives?

(e.g.newproductlines)

Whatriskswilltheorganizationacceptforcompetingobjectives?

(e.g.grossprofitvs.marketshare?)DETERMINERISKAPPETITEQuantificationofriskexposure

Optionsavailable: -Accept=monitor -Avoid=eliminate(getoutofsituation) -Reduce=institutecontrols -Share=partnerwithsomeone

(e.g.insurance)

Residualrisk(unmitigatedrisk–e.g.shrinkage)IDENTIFYRISKRESPONSESImpactvs.ProbabilityControlShareMitigate&ControlAcceptHighRiskMediumRiskMediumRiskLowRiskLowHighHighIMPACTPROBABILITYLowHighHighIMPACTPROBABILITYHighRiskMediumRiskMediumRiskLowRiskExle:CallCenterRiskAssessmentLossofphonesLossofcomputersCreditriskCustomerhasalongwaitCustomercan’tgetthroughCustomercan’tgetanswersEntryerrorsEquipmentobsolescenceRepeatcallsforsameproblemFraudLosttransactionsEmployeemoraleControl

Risk

Control

Objective

ActivityCompleteness Material Accrualof

transaction openliabilities

notrecorded Invoicesaccrued

afterclosing Issue:InvoicesgotofieldandAPisnotawareofliability.Exle:AccountsPayableProcessDashboardofrisksandrelatedresponses

(visualstatusofwherekeyrisksstandrelativetorisktolerances)

Flowchartsofprocesseswithkeycontrolsnoted

Narrativesofbusinessobjectiveslinkedtooperationalrisksandresponses

Listofkeyriskstobemonitoredorused

ManagementunderstandingofkeybusinessriskresponsibilityandcommunicationofassignmentsCommunicateResultsMonitorCollectanddisplayinformation

Performanalysis

-Risksarebeingproperlyaddressed -ControlsareworkingtomitigaterisksAccountabilityfo