COSO_ERM企业风险管理框架

ApplyingCOSOsEnterpriseRiskManagementIntegratedFramework,September29,2004,Todaysorganizationsareconcernedabout:,RiskManagementGovernanceControlAssurance(andConsulting),ERMDefined:,“aprocess,effectedbyanentitysboardofdirectors,managementandotherpersonnel,appliedinstrategysettingandacrosstheenterprise,designedtoidentifypotentialeventsthatmayaffecttheentity,andmanageriskstobewithinitsriskappetite,toprovidereasonableassuranceregardingtheachievementofentityobjectives.”Source:COSOEnterpriseRiskManagementIntegratedFramework.2004.COSO.,WhyERMIsImportant,Underlyingprinciples:Everyentity,whetherfor-profitornot,existstorealizevalueforitsstakeholders.Valueiscreated,preserved,orerodedbymanagementdecisionsinallactivities,fromsettingstrategytooperatingtheenterpriseday-to-day.,WhyERMIsImportant,ERMsupportsvaluecreationbyenablingmanagementto:Dealeffectivelywithpotentialfutureeventsthatcreateuncertainty.Respondinamannerthatreducesthelikelihoodofdownsideoutcomesandincreasestheupside.,ThisCOSOERMframeworkdefinesessentialcomponents,suggestsacommonlanguage,andprovidescleardirectionandguidanceforenterpriseriskmanagement.,EnterpriseRiskManagementIntegratedFramework,TheERMFramework,Entityobjectivescanbeviewedinthecontextoffourcategories:StrategicOperationsReportingCompliance,TheERMFramework,ERMconsidersactivitiesatalllevelsoftheorganization:Enterprise-levelDivisionorsubsidiaryBusinessunitprocesses,Enterpriseriskmanagementrequiresanentitytotakeaportfolioviewofrisk.,TheERMFramework,Managementconsidershowindividualrisksinterrelate.Managementdevelopsaportfolioviewfromtwoperspectives:-Businessunitlevel-Entitylevel,TheERMFramework,Theeightcomponentsoftheframeworkareinterrelated,TheERMFramework,InternalEnvironment,Establishesaphilosophyregardingriskmanagement.Itrecognizesthatunexpectedaswellasexpectedeventsmayoccur.Establishestheentitysriskculture.Considersallotheraspectsofhowtheorganizationsactionsmayaffectitsriskculture.,ObjectiveSetting,Isappliedwhenmanagementconsidersrisksstrategyinthesettingofobjectives.Formstheriskappetiteoftheentityahigh-levelviewofhowmuchriskmanagementandtheboardarewillingtoaccept.Risktolerance,theacceptablelevelofvariationaroundobjectives,isalignedwithriskappetite.,EventIdentification,Differentiatesrisksandopportunities.Eventsthatmayhaveanegativeimpactrepresentrisks.Eventsthatmayhaveapositiveimpactrepresentnaturaloffsets(opportunities),whichmanagementchannelsbacktostrategysetting.,EventIdentification,Involvesidentifyingthoseincidents,occurringinternallyorexternally,thatcouldaffectstrategyandachievementofobjectives.Addresseshowinternalandexternalfactorscombineandinteracttoinfluencetheriskprofile.,RiskAssessment,Allowsanentitytounderstandtheextenttowhichpotentialeventsmightimpactobjectives.Assessesrisksfromtwoperspectives:-Likelihood-ImpactIsusedtoassessrisksandisnormallyalsousedtomeasuretherelatedobjectives.,RiskAssessment,Employsacombinationofbothqualitativeandquantitativeriskassessmentmethodologies.Relatestimehorizonstoobjectivehorizons.Assessesriskonbothaninherentandaresidualbasis.,RiskResponse,Identifiesandevaluatespossibleresponsestorisk.Evaluatesoptionsinrelationtoentitysriskappetite,costvs.benefitofpotentialriskresponses,anddegreetowhicharesponsewillreduceimpactand/orlikelihood.Selectsandexecutesresponsebasedonevaluationoftheportfolioofrisksandresponses.,ControlActivities,Policiesandproceduresthathelpensurethattheriskresponses,aswellasotherentitydirectives,arecarriedout.Occurthroughouttheorganization,atalllevelsandinallfunctions.Includeapplicationandgeneralinformationtechnologycontrols.,Managementidentifies,captures,andcommunicatespertinentinformationinaformandtimeframethatenablespeopletocarryouttheirresponsibilities.Communicationoccursinabroadersense,flowingdown,across,anduptheorganization.,Information&Communication,Monitoring,EffectivenessoftheotherERMcomponentsismonitoredthrough:Ongoingmonitoringactivities.Separateevaluations.Acombinationofthetwo.,InternalControl,Astrongsystemofinternalcontrolisessentialtoeffectiveenterpriseriskmanagement.,ExpandsandelaboratesonelementsofinternalcontrolassetoutinCOSOs“controlframework.”Includesobjectivesettingasaseparatecomponent.Objectivesarea“prerequisite”forinternalcontrol.Expandsthecontrolframeworks“FinancialReporting”and“RiskAssessment.”,RelationshiptoInternalControlIntegratedFramework,ERMRoles&Responsibilities,ManagementTheboardofdirectorsRiskofficersInternalauditors,InternalAuditors,PlayanimportantroleinmonitoringERM,butdoNOThaveprimaryresponsibilityforitsimplementationormaintenance.Assistmanagementandtheboardorauditcommitteeintheprocessby:-Monitoring-Evaluating-Examining-Reporting-Recommendingimprovements,VisittheguidancesectionofTheIIAsWebsiteforTheIIAspositionpaper,“RoleofInternalAuditingsinEnterpriseRiskManagement.”,InternalAuditors,2010.A1Theinternalauditactivitysplanofengagementsshouldbebasedonariskassessment,undertakenatleastannually.2120.A1Basedontheresultsoftheriskassessment,theinternalauditactivityshouldevaluatetheadequacyandeffectivenessofcontrolsencompassingtheorganizationsgovernance,operations,andinformationsystems.2210.A1Whenplanningtheengagement,theinternalauditorshouldidentifyandassessrisksrelevanttotheactivityunderreview.Theengagementobjectivesshouldreflecttheresultsoftheriskassessment.,Standards,OrganizationaldesignofbusinessEstablishinganERMorganizationPerformingriskassessmentsDeterminingoverallriskappetiteIdentifyingriskresponsesCommunicationofriskresultsMonitoringOversight&periodicreviewbymanagement,KeyImplementationFactors,OrganizationalDesign,StrategiesofthebusinessKeybusinessobjectivesRelatedobjectivesthatcascadedowntheorganizationfromkeybusinessobjectivesAssignmentofresponsibilitiestoorganizationalelementsandleaders(linkage),Example:Linkage,MissionToprovidehigh-qualityaccessibleandaffordablecommunity-basedhealthcareStrategicObjectiveTobethefirstorsecondlargest,full-servicehealthcareproviderinmid-sizemetropolitanmarketsRelatedObjectiveToinitiatedialoguewithleadershipof10topunder-performinghospitalsandnegotiateagreementswithtwothisyear,EstablishERM,DetermineariskphilosophySurveyriskcultureConsiderorganizationalintegrityandethicalvaluesDeciderolesandresponsibilities,Example:ERMOrganization,ERMDirector,VicePresidentandChiefRiskOfficer,CorporateCreditRiskManager,InsuranceRiskManager,ERMManager,ERMManager,Staff,Staff,Staff,FESCommodityRiskMg.Director,Riskassessmentistheidentificationandanalysisofriskstotheachievementofbusinessobjectives.Itformsabasisfordetermininghowrisksshouldbemanaged.,AssessRisk,EnvironmentalRisksCapitalAvailabilityRegulatory,Political,andLegalFinancialMarketsandShareholderRelationsProcessRisksOperationsRiskEmpowermentRiskInformationProcessing/TechnologyRiskIntegrityRiskFinancialRiskInformationforDecisionMakingOperationalRiskFinancialRiskStrategicRisk,Example:RiskModel,Source:BusinessRiskAssessment.1998TheInstituteofInternalAuditors,RiskAnalysis,DETERMINERISKAPPETITE,Riskappetiteistheamountofriskonabroadlevelanentityiswillingtoacceptinpursuitofvalue.Usequantitativeorqualitativeterms(e.g.earningsatriskvs.reputationrisk),andconsiderrisktolerance(rangeofacceptablevariation).,Keyquestions:Whatriskswilltheorganizationnotaccept?(e.g.environmentalorqualitycompromises)Whatriskswilltheorganizationtakeonnewinitiatives?(e.g.newproductlines)Whatriskswilltheorganizationacceptforcompetingobjectives?(e.g.grossprofitvs.marketshare?),DETERMINERISKAPPETITE,QuantificationofriskexposureOptionsavailable:-Accept=monitor-Avoid=eliminate(getoutofsituation)-Reduce=institutecontrols-Share=partnerwithsomeone(e.g.insurance)Residualrisk(unmitigatedriske.g.shrinkage),IDENTIFYRISKRESPONSES,Impactvs.Probability,Control,Share,Mitigate&Control,Accept,HighRisk,MediumRisk,MediumRisk,LowRisk,Low,High,High,IMPACT,PROBABILITY,Low,High,High,IMPACT,PROBABILITY,HighRisk,MediumRisk,MediumRisk,LowRisk,Example:CallCenterRiskAssessment,LossofphonesLossofcomputers,CreditriskCustomerhasalongwaitCustomercantgetthroughCustomercantgetanswers,EntryerrorsEquipmentobsolescenceRepeatcallsforsameproblem,FraudLosttransactionsEmployeemorale,ControlRiskControlObjectiveActivity,CompletenessMaterialAccrualoftransactionopenliabilitiesnotrecordedInvoicesaccruedafterclosing,Issue:InvoicesgotofieldandAPisnotawareofliability.,Example:AccountsPayableProcess,Dashboardofrisksandrelatedresponses(visualstatusofwherekeyrisksstandrelativetorisktolerances)FlowchartsofprocesseswithkeycontrolsnotedNarrativesofbusinessobjectiveslinkedtooperationalrisksandresponsesListofkeyriskstobemonitoredorusedManagementunderstandingofkeybusinessriskresponsibilityandcommunicationofassignments,CommunicateResults,Monitor,CollectanddisplayinformationPerformanalysis-Risksarebeingproperlyaddressed-Controlsareworkingtomitigaterisks,AccountabilityforrisksOwnershipUpdates-Changesinbusinessobjectives-Changesinsystems-Changesinprocesses,M