全面風險管理框架英文課件

ApplyingCOSO’s

EnterpriseRiskManagement—IntegratedFrameworkSeptember29,2004ApplyingCOSO’s

EnterpriseRis1Today’sorganizationsareconcernedabout:RiskManagementGovernanceControlAssurance(andConsulting)Today’sorganizationsareconc2ERMDefined:“…aprocess,effectedbyanentity'sboardofdirectors,managementandotherpersonnel,appliedinstrategysettingandacrosstheenterprise,designedtoidentifypotentialeventsthatmayaffecttheentity,andmanageriskstobewithinitsriskappetite,toprovidereasonableassuranceregardingtheachievementofentityobjectives.”Source:COSOEnterpriseRiskManagement–IntegratedFramework.2004.COSO.ERMDefined:“…aprocess,effe3WhyERMIsImportantUnderlyingprinciples:

Everyentity,whetherfor-profit

ornot,existstorealizevaluefor

itsstakeholders.Valueiscreated,preserved,orerodedbymanagementdecisionsinallactivities,fromsettingstrategytooperatingtheenterpriseday-to-day.WhyERMIsImportantUnderlyin4WhyERMIsImportantERMsupportsvaluecreationbyenablingmanagementto:

Dealeffectivelywithpotentialfutureeventsthatcreateuncertainty.Respondinamannerthatreducesthelikelihoodofdownsideoutcomesandincreasestheupside.

WhyERMIsImportantERMsuppo5ThisCOSOERMframeworkdefinesessentialcomponents,suggestsacommonlanguage,andprovidescleardirectionandguidanceforenterpriseriskmanagement.EnterpriseRiskManagement—IntegratedFrameworkThisCOSOERMframeworkdefine6TheERMFrameworkEntityobjectivescanbeviewedinthecontextoffourcategories:

StrategicOperationsReportingComplianceTheERMFrameworkEntityobject7TheERMFrameworkERMconsidersactivitiesatalllevelsoftheorganization:Enterprise-levelDivisionor subsidiaryBusinessunit processesTheERMFrameworkERMconsiders8Enterpriseriskmanagement

requiresanentitytotakeaportfolioviewofrisk.

TheERMFrameworkEnterpriseriskmanagement

req9Managementconsidershow

individualrisksinterrelate.Managementdevelopsaportfolioviewfromtwoperspectives:-Businessunitlevel-EntitylevelTheERMFrameworkManagementconsidershow

indi10Theeightcomponentsoftheframeworkareinterrelated…TheERMFrameworkTheeightcomponentsTheERMFr11InternalEnvironmentEstablishesaphilosophyregardingriskmanagement.Itrecognizesthatunexpectedaswellasexpectedeventsmayoccur.Establishestheentity’sriskculture.Considersallotheraspectsofhowtheorganization’sactionsmayaffectitsriskculture.

InternalEnvironmentEstablishe12ObjectiveSettingIsappliedwhenmanagementconsidersrisksstrategyinthesettingofobjectives.Formstheriskappetiteoftheentity—ahigh-levelviewofhowmuchriskmanagementandtheboardarewillingtoaccept.Risktolerance,theacceptablelevelofvariationaroundobjectives,isalignedwithriskappetite.

ObjectiveSettingIsappliedwh13EventIdentificationDifferentiatesrisksandopportunities.Eventsthatmayhaveanegativeimpactrepresentrisks.Eventsthatmayhaveapositiveimpactrepresentnaturaloffsets(opportunities),whichmanagementchannelsbacktostrategysetting.

EventIdentificationDifferenti14EventIdentificationInvolvesidentifyingthoseincidents,occurringinternallyorexternally,thatcouldaffectstrategyandachievementofobjectives.Addresseshowinternalandexternalfactorscombineandinteracttoinfluencetheriskprofile.

EventIdentificationInvolvesi15RiskAssessmentAllowsanentitytounderstandtheextenttowhichpotentialeventsmightimpactobjectives.Assessesrisksfromtwoperspectives: -Likelihood -Impact

Isusedtoassessrisksandisnormallyalsousedtomeasuretherelatedobjectives.RiskAssessmentAllowsanentit16RiskAssessmentEmploysacombinationofbothqualitativeandquantitativeriskassessmentmethodologies.Relatestimehorizonstoobjectivehorizons.Assessesriskonbothaninherentandaresidualbasis.

RiskAssessmentEmploysacombi17RiskResponseIdentifiesandevaluatespossibleresponsestorisk.Evaluatesoptionsinrelationtoentity’sriskappetite,costvs.benefitofpotentialriskresponses,anddegreetowhicharesponsewillreduceimpactand/orlikelihood.Selectsandexecutesresponsebasedonevaluationoftheportfolioofrisksandresponses.RiskResponseIdentifiesandev18ControlActivitiesPoliciesandproceduresthathelpensurethattheriskresponses,aswellasotherentitydirectives,arecarriedout.Occurthroughouttheorganization,atalllevelsandinallfunctions.Includeapplicationandgeneralinformationtechnologycontrols.ControlActivitiesPoliciesand19Managementidentifies,captures,andcommunicatespertinentinformationinaformandtimeframethatenablespeopletocarryouttheirresponsibilities.

Communicationoccursinabroadersense,flowingdown,across,andup

theorganization.

Information&CommunicationManagementidentifies,capture20MonitoringEffectivenessoftheotherERMcomponentsismonitoredthrough:

Ongoingmonitoringactivities.

Separateevaluations.

Acombinationofthetwo.MonitoringEffectivenessofthe21InternalControlAstrongsystemofinternalcontrolisessentialtoeffectiveenterpriseriskmanagement.

InternalControlAstrongsyste22Expandsandelaboratesonelements

ofinternalcontrolassetoutinCOSO’s

“controlframework.”

Includesobjectivesettingasaseparatecomponent.Objectivesarea“prerequisite”forinternalcontrol.Expandsthecontrolframework’s“FinancialReporting”and“RiskAssessment.”RelationshiptoInternalControl—IntegratedFrameworkExpandsandelaboratesonelem23ERMRoles&ResponsibilitiesManagement

Theboardofdirectors

Riskofficers

InternalauditorsERMRoles&ResponsibilitiesMa24InternalAuditorsPlayanimportantroleinmonitoringERM,butdoNOThaveprimaryresponsibilityforitsimplementation

ormaintenance.

Assistmanagementandtheboardorauditcommitteeintheprocessby: -Monitoring -Evaluating -Examining -Reporting-Recommendingimprovements

InternalAuditorsPlayanimpor25Visittheguidancesectionof

TheIIA’sWebsiteforTheIIA’s

positionpaper,“RoleofInternalAuditing’sinEnterpriseRiskManagement.”InternalAuditorsVisittheguidancesectionof262010.A1–Theinternalauditactivity’splanofengagementsshouldbebasedonariskassessment,undertakenatleastannually.

2120.A1–Basedontheresultsoftheriskassessment,theinternalauditactivityshouldevaluatetheadequacyandeffectivenessofcontrolsencompassingtheorganization’sgovernance,operations,andinformationsystems.2210.A1–Whenplanningtheengagement,theinternalauditorshouldidentifyandassessrisksrelevanttotheactivityunderreview.Theengagementobjectivesshouldreflecttheresultsoftheriskassessment.Standards2010.A1–Theinternalaudita27OrganizationaldesignofbusinessEstablishinganERMorganizationPerformingriskassessmentsDeterminingoverallriskappetiteIdentifyingriskresponsesCommunicationofriskresultsMonitoringOversight&periodicreview

bymanagementKeyImplementationFactorsOrganizationaldesignofbusin28OrganizationalDesignStrategiesofthebusinessKeybusinessobjectivesRelatedobjectivesthatcascade

downtheorganizationfromkeybusinessobjectivesAssignmentofresponsibilitiestoorganizationalelementsandleaders(linkage)OrganizationalDesignStrategie29Example:LinkageMission–Toprovidehigh-qualityaccessibleandaffordablecommunity-basedhealthcare

StrategicObjective–Tobethefirst

orsecondlargest,full-servicehealth

careproviderinmid-sizemetropolitanmarkets

RelatedObjective–Toinitiate

dialoguewithleadershipof10topunder-performinghospitalsandnegotiateagreementswithtwothisyearExample:LinkageMission–Top30EstablishERMDetermineariskphilosophy

Surveyriskculture

Considerorganizationalintegrity

andethicalvaluesDeciderolesandresponsibilitiesEstablishERMDeterminearisk31Example:ERMOrganizationERM

DirectorVicePresidentand

ChiefRiskOfficerCorporateCredit

RiskManagerInsurance

RiskManagerERM

ManagerERM

ManagerStaffStaffStaffFES

Commodity

RiskMg.DirectorExample:ERMOrganizationERM

32Riskassessmentistheidentificationandanalysisofriskstotheachievementofbusinessobjectives.Itformsabasisfordetermininghowrisksshouldbemanaged.AssessRiskRiskassessmentistheidentif33EnvironmentalRisksCapitalAvailabilityRegulatory,Political,andLegalFinancialMarketsandShareholderRelationsProcessRisksOperationsRiskEmpowermentRiskInformationProcessing/TechnologyRiskIntegrityRiskFinancialRiskInformationforDecisionMakingOperationalRiskFinancialRiskStrategicRiskExample:RiskModelEnvironmentalRisksExample:Ri34Source:BusinessRiskAssessment.1998–TheInstituteofInternalAuditorsControlItShareorTransferItDiversifyorAvoidItRiskManagementProcessLevelActivityLevelEntityLevelRiskMonitoring

IdentificationMeasurementPrioritizationRiskAssessmentRiskAnalysis

Source:BusinessRiskAssessm35DETERMINERISKAPPETITERiskappetiteistheamountofrisk—onabroadlevel—anentityiswillingtoacceptinpursuitofvalue.Usequantitativeorqualitativeterms(e.g.earningsatriskvs.reputationrisk),andconsiderrisktolerance(rangeofacceptablevariation).DETERMINERISKAPPETITERiskap36Keyquestions:Whatriskswilltheorganizationnotaccept?

(e.g.environmentalorqualitycompromises)

Whatriskswilltheorganizationtakeonnewinitiatives?

(e.g.newproductlines)

Whatriskswilltheorganizationacceptforcompetingobjectives?

(e.g.grossprofitvs.marketshare?)DETERMINERISKAPPETITEKeyquestions:DETERMINERISKA37Quantificationofriskexposure

Optionsavailable: -Accept=monitor -Avoid=eliminate(getoutofsituation) -Reduce=institutecontrols -Share=partnerwithsomeone

(e.g.insurance)

Residualrisk(unmitigatedrisk–e.g.shrinkage)IDENTIFYRISKRESPONSESQuantificationofriskexposur38Impactvs.ProbabilityControlShareMitigate&ControlAcceptHighRiskMediumRiskMediumRiskLowRiskLowHighHighIMPACTPROBABILITYImpactvs.ProbabilityControlS39LowHighHighIMPACTPROBABILITYHighRiskMediumRiskMediumRiskLowRiskExample:CallCenterRiskAssessmentLossofphonesLossofcomputersCreditriskCustomerhasalongwaitCustomercan’tgetthroughCustomercan’tgetanswersEntryerrorsEquipmentobsolescenceRepeatcallsforsameproblemFraudLosttransactionsEmployeemoraleLowHighHighIPROBABILITYHighRi40Control

Risk

Control

Objective

ActivityCompleteness

Material Accrualof

transaction openliabilities

notrecorded Invoicesaccrued

afterclosing Issue:InvoicesgotofieldandAPisnotawareofliability.Example:AccountsPayableProcessControl Risk Control

Objecti41Dashboardofrisksandrelatedresponses

(visualstatusofwherekeyrisksstandrelativetorisktolerances)

Flowchartsofprocesseswithkeycontrolsnoted

Narrativesofbusinessobjectiveslinkedtooperationalrisksandresponses

Listofkeyriskstobemonitoredorused

ManagementunderstandingofkeybusinessriskresponsibilityandcommunicationofassignmentsCommunicateResultsDashboardofrisksandrelated42MonitorCollectanddisplayinformation

Performanalysis

-Risksarebeingproperlyaddressed -ControlsareworkingtomitigaterisksMonitorCollectanddisplayinf43Accountabilityforrisks

Ownership

Updates -Changesinbusinessobjectives -Changesinsystems -ChangesinprocessesManagementOversight&PeriodicReview

Accountabilityforrisks

Manag44Internalauditorscanaddvalueby:Reviewingcriticalcontrolsystemsandriskmanagementprocesses.Performinganeffectivenessreviewofmanagement'sriskassessmentsandtheinternalcontrols.Providingadviceinthedesignandimprovementofcontrolsystemsandriskmitigationstrategies.Internalauditorscanaddvalu45Implementingarisk-basedapproachtoplanningandexecutingtheinternalauditprocess.Ensuringthatinternalauditing’sresourcesaredirectedatthoseareasmostimportanttotheorganization.Challengingthebasisofmanagement’sriskassessmentsandevaluatingtheadequacyandeffectivenessofrisktreatmentstrategies.

Internalauditorscanaddvalueby:Implementingarisk-basedappr46FacilitatingERMworkshops.Definingrisktoleranceswherenonehavebeenidentified,basedoninternalauditing'sexperience,judgment,andconsultationwithmanagement.Internalauditorscanaddvalueby:FacilitatingERMworkshops.Int47FormoreinformationOnCOSO’sEnterpriseRiskManagement—IntegratedFramework,visitorFormoreinformationOnCOSO’s48ThispresentationwasproducedbyApplyingCOSO’s

EnterpriseRiskManagement—IntegratedFrameworkThispresentationApplyingCOS49ApplyingCOSO’s

EnterpriseRiskManagement—IntegratedFrameworkSeptember29,2004ApplyingCOSO’s

EnterpriseRis50Today’sorganizationsareconcernedabout:RiskManagementGovernanceControlAssurance(andConsulting)Today’sorganizationsareconc51ERMDefined:“…aprocess,effectedbyanentity'sboardofdirectors,managementandotherpersonnel,appliedinstrategysettingandacrosstheenterprise,designedtoidentifypotentialeventsthatmayaffecttheentity,andmanageriskstobewithinitsriskappetite,toprovidereasonableassuranceregardingtheachievementofentityobjectives.”Source:COSOEnterpriseRiskManagement–IntegratedFramework.2004.COSO.ERMDefined:“…aprocess,effe52WhyERMIsImportantUnderlyingprinciples:

Everyentity,whetherfor-profit

ornot,existstorealizevaluefor

itsstakeholders.Valueiscreated,preserved,orerodedbymanagementdecisionsinallactivities,fromsettingstrategytooperatingtheenterpriseday-to-day.WhyERMIsImportantUnderlyin53WhyERMIsImportantERMsupportsvaluecreationbyenablingmanagementto:

Dealeffectivelywithpotentialfutureeventsthatcreateuncertainty.Respondinamannerthatreducesthelikelihoodofdownsideoutcomesandincreasestheupside.

WhyERMIsImportantERMsuppo54ThisCOSOERMframeworkdefinesessentialcomponents,suggestsacommonlanguage,andprovidescleardirectionandguidanceforenterpriseriskmanagement.EnterpriseRiskManagement—IntegratedFrameworkThisCOSOERMframeworkdefine55TheERMFrameworkEntityobjectivescanbeviewedinthecontextoffourcategories:

StrategicOperationsReportingComplianceTheERMFrameworkEntityobject56TheERMFrameworkERMconsidersactivitiesatalllevelsoftheorganization:Enterprise-levelDivisionor subsidiaryBusinessunit processesTheERMFrameworkERMconsiders57Enterpriseriskmanagement

requiresanentitytotakeaportfolioviewofrisk.

TheERMFrameworkEnterpriseriskmanagement

req58Managementconsidershow

individualrisksinterrelate.Managementdevelopsaportfolioviewfromtwoperspectives:-Businessunitlevel-EntitylevelTheERMFrameworkManagementconsidershow

indi59Theeightcomponentsoftheframeworkareinterrelated…TheERMFrameworkTheeightcomponentsTheERMFr60InternalEnvironmentEstablishesaphilosophyregardingriskmanagement.Itrecognizesthatunexpectedaswellasexpectedeventsmayoccur.Establishestheentity’sriskculture.Considersallotheraspectsofhowtheorganization’sactionsmayaffectitsriskculture.

InternalEnvironmentEstablishe61ObjectiveSettingIsappliedwhenmanagementconsidersrisksstrategyinthesettingofobjectives.Formstheriskappetiteoftheentity—ahigh-levelviewofhowmuchriskmanagementandtheboardarewillingtoaccept.Risktolerance,theacceptablelevelofvariationaroundobjectives,isalignedwithriskappetite.

ObjectiveSettingIsappliedwh62EventIdentificationDifferentiatesrisksandopportunities.Eventsthatmayhaveanegativeimpactrepresentrisks.Eventsthatmayhaveapositiveimpactrepresentnaturaloffsets(opportunities),whichmanagementchannelsbacktostrategysetting.

EventIdentificationDifferenti63EventIdentificationInvolvesidentifyingthoseincidents,occurringinternallyorexternally,thatcouldaffectstrategyandachievementofobjectives.Addresseshowinternalandexternalfactorscombineandinteracttoinfluencetheriskprofile.

EventIdentificationInvolvesi64RiskAssessmentAllowsanentitytounderstandtheextenttowhichpotentialeventsmightimpactobjectives.Assessesrisksfromtwoperspectives: -Likelihood -Impact

Isusedtoassessrisksandisnormallyalsousedtomeasuretherelatedobjectives.RiskAssessmentAllowsanentit65RiskAssessmentEmploysacombinationofbothqualitativeandquantitativeriskassessmentmethodologies.Relatestimehorizonstoobjectivehorizons.Assessesriskonbothaninherentandaresidualbasis.

RiskAssessmentEmploysacombi66RiskResponseIdentifiesandevaluatespossibleresponsestorisk.Evaluatesoptionsinrelationtoentity’sriskappetite,costvs.benefitofpotentialriskresponses,anddegreetowhicharesponsewillreduceimpactand/orlikelihood.Selectsandexecutesresponsebasedonevaluationoftheportfolioofrisksandresponses.RiskResponseIdentifiesandev67ControlActivitiesPoliciesandproceduresthathelpensurethattheriskresponses,aswellasotherentitydirectives,arecarriedout.Occurthroughouttheorganization,atalllevelsandinallfunctions.Includeapplicationandgeneralinformationtechnologycontrols.ControlActivitiesPoliciesand68Managementidentifies,captures,andcommunicatespertinentinformationinaformandtimeframethatenablespeopletocarryouttheirresponsibilities.

Communicationoccursinabroadersense,flowingdown,across,andup

theorganization.

Information&CommunicationManagementidentifies,capture69MonitoringEffectivenessoftheotherERMcomponentsismonitoredthrough:

Ongoingmonitoringactivities.

Separateevaluations.

Acombinationofthetwo.MonitoringEffectivenessofthe70InternalControlAstrongsystemofinternalcontrolisessentialtoeffectiveenterpriseriskmanagement.

InternalControlAstrongsyste71Expandsandelaboratesonelements

ofinternalcontrolassetoutinCOSO’s

“controlframework.”

Includesobjectivesettingasaseparatecomponent.Objectivesarea“prerequisite”forinternalcontrol.Expandsthecontrolframework’s“FinancialReporting”and“RiskAssessment.”RelationshiptoInternalControl—IntegratedFrameworkExpandsandelaboratesonelem72ERMRoles&ResponsibilitiesManagement

Theboardofdirectors

Riskofficers

InternalauditorsERMRoles&ResponsibilitiesMa73InternalAuditorsPlayanimportantroleinmonitoringERM,butdoNOThaveprimaryresponsibilityforitsimplementation

ormaintenance.

Assistmanagementandtheboardorauditcommitteeintheprocessby: -Monitoring -Evaluating -Examining -Reporting-Recommendingimprovements

InternalAuditorsPlayanimpor74Visittheguidancesectionof

TheIIA’sWebsiteforTheIIA’s

positionpaper,“RoleofInternalAuditing’sinEnterpriseRiskManagement.”InternalAuditorsVisittheguidancesectionof752010.A1–Theinternalauditactivity’splanofengagementsshouldbebasedonariskassessment,undertakenatleastannually.

2120.A1–Basedontheresultsoftheriskassessment,theinternalauditactivityshouldevaluatetheadequacyandeffectivenessofcontrolsencompassingtheorganization’sgovernance,operations,andinformationsystems.2210.A1–Whenplanningtheengagement,theinternalauditorshouldidentifyandassessrisksrelevanttotheactivityunderreview.Theengagementobjectivesshouldreflecttheresultsoftheriskassessment.Standards2010.A1–Theinternalaudita76OrganizationaldesignofbusinessEstablishinganERMorganizationPerformingriskassessmentsDeterminingoverallriskappetiteIdentifyingriskresponsesCommunicationofriskresultsMonitoringOversight&periodicreview

bymanagementKeyImplementationFactorsOrganizationaldesignofbusin77OrganizationalDesignStrategiesofthebusinessKeybusinessobjectivesRelatedobjectivesthatcascade

downtheorganizationfromkeybusinessobjectivesAssignmentofresponsibilitiestoorganizationalelementsandleaders(linkage)OrganizationalDesignStrategie78Example:LinkageMission–Toprovidehigh-qualityaccessibleandaffordablecommunity-basedhealthcare

StrategicObjective–Tobethefirst

orsecondlargest,full-servicehealth

careproviderinmid-sizemetropolitanmarkets

RelatedObjective–Toinitiate

dialoguewithleadershipof10topunder-performinghospitalsandnegotiateagreementswithtwothisyearExample:LinkageMission–Top79EstablishERMDetermineariskphilosophy

Surveyriskculture

Considerorganizationalintegrity

andethicalvaluesDeciderolesandresponsibilitiesEstablishERMDeterminearisk80Example:ERMOrganizationERM

DirectorVicePresidentand

ChiefRiskOfficerCorporateCredit

RiskManagerInsurance

RiskManagerERM

ManagerERM

ManagerStaffStaffStaffFES

Commodity

RiskMg.DirectorExample:ERMOrganizationERM

81Riskassessmentistheidentificationandanalysisofriskstotheachievementofbusinessobjectives.Itformsabasisfordetermininghowrisksshouldbemanaged.AssessRiskRiskassessmentistheidentif82EnvironmentalRisksCapitalAvailabilityRegulatory,Political,andLegalFinancialMarketsandShareholderRelationsProcessRisksOperationsRiskEmpowermentRiskInformationProcessing/TechnologyRiskIntegrityRiskFinancialRiskInformationforDecisionMakingOperationalRiskFinancialRiskStrategicRiskExample:RiskModelEnvironmentalRisksExample:Ri83Source:BusinessRiskAssessment.1998–TheInstituteofInternalAuditorsControlItShareorTransferItDiversifyorAvoidItRiskManagementProcessLevelActivityLevelEntityLevelRiskMonitoring

IdentificationMeasurementPrioritizationRiskAssessmentRiskAnalysis

Source:BusinessRiskAssessm84DETERMINERISKAPPETITERiskappetiteistheamountofrisk—onabroadlevel—anentityiswillingtoacceptinpursuitofvalue.Usequantitativeorqualitativeterms(e.g.earningsatriskvs.reputationrisk),andconsiderrisktolerance(rangeofacceptablevariation).DETERMINERISKAPPETITERiskap85Keyquestions:Whatriskswilltheorganizationnotaccept?

(e.g.environmentalorqualitycompromises)

Whatriskswilltheorganizationtakeonnewinitiatives?

(e.g.newproductlines)

Whatriskswilltheorganizationacceptforcompetingobjectives?

(e.g.grossprofitvs.marketshare?)DETERMINERISKAPPETITEKeyquestions:DETERMINERISKA86Quantificationofriskexposure

Optionsavailable: -Accept=monitor -Avoid=eliminate(getoutofsituation) -Reduce=institutecontrols -Share=partnerwithsomeone

(e.g.insurance)

Residualrisk(unmitigatedrisk–e.g.shrinkage)IDENTIFYRISKRESPONSESQuantificationofriskexposur87Impactvs.ProbabilityControlShareMitigate&ControlAcceptHighRiskMediumRiskMediumRiskLowRiskLowHighHighIMPACTPROBABILITYImpactvs.ProbabilityControlS88LowHighHighIMPACTPROBABILITYHighRiskMediumRiskMediumRisk