coso_erm企业风险管理框架

《coso_erm企业风险管理框架》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

xxEnterpriseRiskManagement—IntegratedFramework Today’sorganizationsareconcernedabout:RiskManagementGovernanceControlAssurance(andConsulting) ERMDefined:“…aprocess,effectedbyanentity'sboardofdirectors,managementandotherpersonnel,appliedinstrategysettingandacrosstheenterprise,designedtoidentifypotentialeventsthatmayaffecttheentity,andmanageriskstobewithinitsriskappetite,toprovidereasonableassuranceregardingtheachievementofentityobjectives.”Source:COSOEnterpriseRiskManagement–IntegratedFramework.2004.COSO. WhyERMIsImportantUnderlyingprinciples:Everyentity,whetherfor-profitornot,existstorealizevalueforitsstakeholders.Valueiscreated,preserved,orerodedbymanagementdecisionsinallactivities,fromsettingstrategytooperatingtheenterpriseday-to-day. WhyERMIsImportantERMsupportsvaluecreationbyenablingmanagementto:Dealeffectivelywithpotentialfutureeventsthatcreateuncertainty.Respondinamannerthatreducesthelikelihoodofdownsideoutcomesandincreasestheupside. ThisCOSOERMframeworkdefinesessentialcomponents,suggestsacommonlanguage,andprovidescleardirectionandguidanceforenterpriseriskmanagement.EnterpriseRiskManagement—IntegratedFramework TheERMFrameworkEntityobjectivescanbeviewedinthecontextoffourcategories:StrategicOperationsReportingCompliance TheERMFrameworkERMconsidersactivitiesatalllevelsoftheorganization:Enterprise-levelDivisionorsubsidiaryBusinessunitprocesses Enterpriseriskmanagementrequiresanentitytotakeaportfolioviewofrisk.TheERMFramework Managementconsidershowindividualrisksinterrelate.Managementdevelopsaportfolioviewfromtwoperspectives:-Businessunitlevel-EntitylevelTheERMFramework Theeightcomponentsoftheframeworkareinterrelated…TheERMFramework InternalEnvironmentEstablishesaphilosophyregardingriskmanagement.Itrecognizesthatunexpectedaswellasexpectedeventsmayoccur.Establishestheentity’sriskculture.Considersallotheraspectsofhowtheorganization’sactionsmayaffectitsriskculture. ObjectiveSettingIsappliedwhenmanagementconsidersrisksstrategyinthesettingofobjectives.Formstheriskappetiteoftheentity—ahigh-levelviewofhowmuchriskmanagementandtheboardarewillingtoaccept.Risktolerance,theacceptablelevelofvariationaroundobjectives,isalignedwithriskappetite. EventIdentificationDifferentiatesrisksandopportunities.Eventsthatmayhaveanegativeimpactrepresentrisks.Eventsthatmayhaveapositiveimpactrepresentnaturaloffsets(opportunities),whichmanagementchannelsbacktostrategysetting. EventIdentificationInvolvesidentifyingthoseincidents,occurringinternallyorexternally,thatcouldaffectstrategyandachievementofobjectives.Addresseshowinternalandexternalfactorscombineandinteracttoinfluencetheriskprofile. RiskAssessmentAllowsanentitytounderstandtheextenttowhichpotentialeventsmightimpactobjectives.Assessesrisksfromtwoperspectives:-Likelihood-ImpactIsusedtoassessrisksandisnormallyalsousedtomeasuretherelatedobjectives. RiskAssessmentEmploysacombinationofbothqualitativeandquantitativeriskassessmentmethodologies.Relatestimehorizonstoobjectivehorizons.Assessesriskonbothaninherentandaresidualbasis. RiskResponseIdentifiesandevaluatespossibleresponsestorisk.Evaluatesoptionsinrelationtoentity’sriskappetite,costvs.benefitofpotentialriskresponses,anddegreetowhicharesponsewillreduceimpactand/orlikelihood.Selectsandexecutesresponsebasedonevaluationoftheportfolioofrisksandresponses. ControlActivitiesPoliciesandproceduresthathelpensurethattheriskresponses,aswellasotherentitydirectives,arecarriedout.Occurthroughouttheorganization,atalllevelsandinallfunctions.Includeapplicationandgeneralinformationtechnologycontrols. Managementidentifies,captures,andcommunicatespertinentinformationinaformandtimeframethatenablespeopletocarryouttheirresponsibilities.Communicationoccursinabroadersense,flowingdown,across,anduptheorganization.Information&Communication MonitoringEffectivenessoftheotherERMcomponentsismonitoredthrough:Ongoingmonitoringactivities.Separateevaluations.Acombinationofthetwo. InternalControlAstrongsystemofinternalcontrolisessentialtoeffectiveenterpriseriskmanagement. ExpandsandelaboratesonelementsofinternalcontrolassetoutinCOSO’s“controlframework.”Includesobjectivesettingasaseparatecomponent.Objectivesarea“prerequisite”forinternalcontrol.Expandsthecontrolframework’s“FinancialReporting”and“RiskAssessment.”RelationshiptoInternalControl—IntegratedFramework ERMRoles&ResponsibilitiesManagementTheboardofdirectorsRiskofficersInternalauditors InternalAuditorsPlayanimportantroleinmonitoringERM,butdoNOThaveprimaryresponsibilityforitsimplementationormaintenance.Assistmanagementandtheboardorauditcommitteeintheprocessby:-Monitoring-Evaluating-Examining-Reporting-Recommendingimprovements VisittheguidancesectionofTheIIA’sWebsiteforTheIIA’spositionpaper,“RoleofInternalAuditing’sinEnterpriseRiskManagement.”InternalAuditors 2010.A1–Theinternalauditactivity’splanofengagementsshouldbebasedonariskassessment,undertakenatleastannually.2120.A1–Basedontheresultsoftheriskassessment,theinternalauditactivityshouldevaluatetheadequacyandeffectivenessofcontrolsencompassingtheorganization’sgovernance,operations,andinformationsystems.2210.A1–Whenplanningtheengagement,theinternalauditorshouldidentifyandassessrisksrelevanttotheactivityunderreview.Theengagementobjectivesshouldreflecttheresultsoftheriskassessment.Standards OrganizationaldesignofbusinessEstablishinganERMorganizationPerformingriskassessmentsDeterminingoverallriskappetiteIdentifyingriskresponsesCommunicationofriskresultsMonitoringOversight&periodicreviewbymanagementKeyImplementationFactors OrganizationalDesignStrategiesofthebusinessKeybusinessobjectivesRelatedobjectivesthatcascadedowntheorganizationfromkeybusinessobjectivesAssignmentofresponsibilitiestoorganizationalelementsandleaders(linkage) Example:LinkageMission–Toprovidehigh-qualityaccessibleandaffordablecommunity-basedhealthcareStrategicObjective–Tobethefirstorsecondlargest,full-servicehealthcareproviderinmid-sizemetropolitanmarketsRelatedObjective–Toinitiatedialoguewithleadershipof10topunder-performinghospitalsandnegotiateagreementswithtwothisyear EstablishERMDetermineariskphilosophySurveyriskcultureConsiderorganizationalintegrityandethicalvaluesDeciderolesandresponsibilities Example:ERMOrganizationERMDirectorVicePresidentandChiefRiskOfficerCorporateCreditRiskManagerInsuranceRiskManagerERMManagerERMManagerStaffStaffStaffFESCommodityRiskMg.Director Riskassessmentistheidentificationandanalysisofriskstotheachievementofbusinessobjectives.Itformsabasisfordetermininghowrisksshouldbemanaged.AssessRisk EnvironmentalRisksCapitalAvailabilityRegulatory,Political,andLegalFinancialMarketsandShareholderRelationsProcessRisksOperationsRiskEmpowermentRiskInformationProcessing/TechnologyRiskIntegrityRiskFinancialRiskInformationforDecisionMakingOperationalRiskFinancialRiskStrategicRiskExample:RiskModel Source:BusinessRiskAssessment.1998–TheInstituteofInternalAuditorsControlItShareorTransferItDiversifyorAvoidItRiskManagementProcessLevelActivityLevelEntityLevelRiskMonitoringIdentificationMeasurementPrioritizationRiskAssessmentRiskAnalysis DETERMINERISKAPPETITERiskappetiteistheamountofrisk—onabroadlevel—anentityiswillingtoacceptinpursuitofvalue.Usequantitativeorqualitativeterms(e.g.earningsatriskvs.reputationrisk),andconsiderrisktolerance(rangeofacceptablevariation). Keyquestions:Whatriskswilltheorganizationnotaccept?(e.g.environmentalorqualitycompromises)Whatriskswilltheorganizationtakeonnewinitiatives?(e.g.newproductlines)Whatriskswilltheorganizationacceptforcompetingobjectives?(e.g.grossprofitvs.marketshare?)DETERMINERISKAPPETITE QuantificationofriskexposureOptionsavailable:-Accept=monitor-Avoid=eliminate(getoutofsituation)-Reduce=institutecontrols-Share=partnerwithsomeone(e.g.insurance)Residualrisk(unmitigatedrisk–e.g.shrinkage)IDENTIFYRISKRESPONSES Impactvs.ProbabilityControlShareMitigate&ControlAcceptHighRiskMediumRiskMediumRiskLowRiskLowHighHighIMPACTPROBABILITY LowHighHighIMPACTPROBABILITYHighRiskMediumRiskMediumRiskLowRiskExample:CallCenterRiskAssessmentLossofphonesLossofcomputersCreditriskCustomerhasalongwaitCustomercan’tgetthroughCustomercan’tgetanswersEntryerrorsEquipmentobsolescenceRepeatcallsforsameproblemFraudLosttransactionsEmployeemorale ControlRiskControlObjectiveActivityCompletenessMaterialAccrualoftransactionopenliabilitiesnotrecordedInvoicesaccruedafterclosingIssue:InvoicesgotofieldandAPisnotawareofliability.Example:AccountsPayableProcess Dashboardofrisksandrelatedresponses(visualstatusofwherekeyrisksstandrelativetorisktolerances)FlowchartsofprocesseswithkeycontrolsnotedNarrativesofbusinessobjectiveslinkedtooperationalrisksandresponsesListofkeyriskstobemonitoredorusedManagementunderstandingofkeybusinessriskresponsibilityandcommunicationofassignmentsCommunicateResults MonitorCollectanddisplayinformationPerformanalysis-Risksarebeingproperlyaddressed-Controlsareworkingtomitigaterisks AccountabilityforrisksOwnershipUpdates-Changesinbusinessobjectives-Changesinsystems-ChangesinprocessesManagementOversight&PeriodicReview Internalauditorscanaddvalueby:Reviewingcriticalcontrolsystemsandriskmanagementprocesses.Performinganeffectivenessreviewofmanagement'sriskassessmentsandtheinternalcontrols.Providingadviceinthedesignandimprovementofcontrolsystemsandriskmitigationstrategies. Implementingarisk-basedapproachtoplanningandexecutingtheinternalauditprocess.Ensuringthatinternalauditing’sresourcesaredirectedatthoseareasmostimportanttotheorganization.Challengingthebasisofmanagement’sriskassessmentsandevaluatingtheadequacyandeffectivenessofrisktreatmentstrategies.Internalauditorscanaddvalueby: FacilitatingERMworkshops.Definingrisktoleranceswherenonehavebeenidentified,basedoninternalauditing'sexperience,judgment,andconsultationwithmanagement.Internalauditorscanaddvalueby: FormoreinformationOnCOSO’sEnterpriseRiskManagement—IntegratedFramework,visitwww.coso.orgorwww.theiia.org ThispresentationwasproducedbyxxEnterpriseRiskManagement—IntegratedFramework