高级管理会计学课件：Lesson 3 Risk management

1、1Risk management LESSON32Introduction of lesson 3Describe the risk environment and the types of risk faced by an organizationDescribe board, management and employee responsibilities in managing riskSummarize how risk is evaluatedDescribe techniques for mitigating risk3Lesson 3 Topics outlineRisk env

2、ironment and types of risk Level of risk management Evaluating risk Techniques for mitigating riskCase analysis: Entropic communications, Inc4Topic 1: Risk environment and types of riskLEARNING OBJECTIVE Describe the risk environment and the types of risk faced by an organization. (Level 2)Required

3、readingNo required readingRisk is the probability that a negative outcome will occur.Risk Managementis the process of deploying resources to assess , monitor, and control the probability of risk, and mitigate negative events.Enterprise-Wide Risk ManagementThe formal mechanism or structure for managi

4、ng risks across the entire organization on an integrated basis.DefinitionsGenealogy of risk managementTraditional Risk Management 1960sFinancial Risk Management 1980sEnterprise Risk Management 1990sTraditional Risk ManagementFormally developed as a field in the 1960sPioneers were two insurance profe

5、ssors at the University of IllinoisBob Mehr and Bob HedgesRisk Management in the Business Enterprise, 1963Focused on “pure” risks Loss/no loss situationOften could be insuredManaging risk involved reducing frequency or severity of lossesNew Elements of Risk 1970sForeign exchange risk End of Bretton

6、Woods agreement in 1972Commodity price riskOil price fluctuations of the 1970sEquity riskDevelopment of option markets - 1973 Interest rate risk U. S. Federal Reserve Board policy shift 1979 Similar changes worldwideThe “New” Risk Management -1980sFinancial risk management Dealt with financial riskF

7、oreign exchange riskInterest rate riskEquity riskCommodity price riskUse derivatives to hedge financial riskFinancial Risk Management ToolboxForwards ( 远期)Futures (期货)Options (期权)Swaps (掉期)New Elements of Risk 1990sFailure to manage derivatives appropriately Barings BankFinancial model failures Long

8、 Term Capital ManagementImproper accounting for derivatives Enron and Arthur AndersenOperational risk failures East Asia currency crisis The “New” Risk Management - 1990s and beyondEnterprise Risk ManagementInitial focus on avoiding derivative disastersHistory of managing risk, not managing performa

9、nceSlowly developing into optimizing firm valueChief Risk Officer (1993)Sarbanes-Oxley Act 2002Basel IISolvency IIIncreased focus on risk modelsEnterprise Risk Management is the discipline by which an organization in any industry assesses, controls, exploits, finances, and monitors risks from all so

10、urces for the purpose of increasing the organizations short and long-term value to its stakeholders.A ERM process that includes Identification of potential events that may impact objectivesRisk assessment and response Consideration of risks in formulation of strategyApplication across the entityMana

11、ging risk is to be within the entitys risk appetiteA portfolio view of risks at the entity-level is takenMonitoring the performance of ERMEnterprise risk management The Value of ERMA survey by Federation of European Risk Management Associations found firms with a more mature approach to Risk Managem

12、ent have better financial results. 75% more firms with advanced risk management practices had Earning Before Interest Taxes Depreciation and Amortization (EBITDA) growth of over 10%62% more firms with advanced risk management practices attained annual revenue growth of 10%.Creating an active risk cu

13、lture is correlated with higher growth, as the company becomes more aware and accountable for risk. Source: 2012 study by Federation of European Risk Management AssociationsThe Problem With “Risk Management”Risk ManagementFocus was on pure risk (insurable, hazard)Financial Risk ManagementValue-at-Ri

14、sk measure of certain percentile lossEnterprise Risk ManagementIncorporates all risks facing an organizationName suggests focus still on managing downside riskCOSO ERM FrameworkCOSO 1COSO2（内部控制企业风险管理）构建以风险为导向的内部控制体系促进企业可持续发展COSO 1COSO2COSO internal control frameworkIn 1992, COSO issued the “Internal

15、 ControlIntegrated Framework” 1. Defined internal controls:2. Provided guidance for evaluating and enhancing internal control systems.3. Widely accepted as the authority on internal controls.4. Incorporated into policies, rules, and regulations5. used to control business activities.COSO internal con

16、trol frameworkDefinition of Internal Control :Internal control is a process, effected by an entitys board of directors, management and other personnel, designed to provide reasonable assurance regarding the achievement of objectives in the following categories: Effectiveness and efficiency of operat

17、ions Reliability of financial reporting (SOX Focus) Compliance with applicable laws and regulationsCOSO internal control frameworkCOSOs internal control model had five key components:1. Control environment;2. Control activities;3. Risk assessment;4. Information and communication; and5. Monitoring.CO

18、SO ERM frameworkNine years after COSO issued the its framework, it began investigating how to effectively identify, assess, and manage risk so organizations could improve the risk management process.Note that the framework has been expanded to focus on enterprise risk management ERM.ERM is the appli

19、cation of basic risk management principles to all risks facing an organizationCOSO ERM frameworkEnterprise risk management: a process, effected by an entitys board of directors, management and other personnel, applied in strategy setting and across the enterprise, designed to identify potential even

20、ts that may affect the entity, and manage risks to be within its risk appetite, to provide reasonable assurance regarding the achievement of entity objectives.”“企业风险管理是由企业的董事会、管理层和其他人员实施的，运用于战略制定，并贯穿整个企业的一个过程。这个过程的设计是为了及时识别可能影响企业的潜在事件，将风险控制在风险偏好范围内，为实现企业目标提供合理的保证。”Risk appetite(风险偏好):The level of ri

21、sk that an organization is prepared to accept, before action is deemed necessary to reduce it. It represents a balance between the potential benefits of innovation and the threats that change inevitably brings.Risk Tolerance (风险容忍度): The degree of variability in investment returns that an individual

22、 is willing to withstand. 24Emphasizes “Enterprise” not just selected “silos of risk”Consideration of risks on “portfolio” basisCollection of risksInteractions of risksDone to enhance entity valueHeavily integrated with business strategyFocus is on identification, measurement, assessment, and respon

23、se to risks primarily across 2 dimensionsProbability (Likelihood)Criticality (Consequence)Key part of entitys corporate governanceResponsibility of senior management and boardPushed down to key business segment managementKey Elements to COSO ERMCOSO ERM frameworkThe COSO framework is like a Rubics C

24、ube.COSO ERM frameworkColumns at the top represent the four types of objectives that management must meet to achieve company goals.- Strategic objectives- Operations objectives- Reporting objectives- Compliance objectivesCOSO ERM frameworkColumns on the rightrepresent the companys units:- Entire com

25、pany- Division- Business unitSubsidiaryERM considers activities at all levels of the organizationCOSO ERM frameworkThe horizontal rows are eight related risk and control components, including:- Internal environment- Objective setting- Event identification- Risk assessment- Risk response- Control act

26、ivities- Information and communicated- MonitoringInternal EnvironmentEstablishes a philosophy regarding risk management. It recognizes that unexpected as well as expected events may occur. Establishes the entitys risk culture.Considers all other aspects of the organizations actions, including:oversi

27、ght by the board of directorsThe integrity and ethical values Competence of the entitys peopleManagements philosophy and operating styleThe organizational structure of the entityMechanisms used by management to assign authority and responsibilityMechanisms used my management to organize and develop

28、its people.Objective SettingIs applied in objective-setting when management considers risks strategy in the setting of objectives.Forms a risk appetite at the entity level. This risk appetite is encompassed in policy, guidelines and procedures. It is a high-level view of how much risk management and

29、 the board are willing to accept. Establishes risk tolerances, which are the acceptable level of variation around objectives, and align with risk appetite. Event IdentificationDistinguishes risk and opportunityEvents that may have a negative impact represent risks.Events that may have a positive imp

30、act represent natural offsets or, opportunities, which management channels back to strategy setting.Involves identifying those incidents, occurring internally or externally, that could affect strategy and achievement of objectives.Addresses how internal and external factors combine and interact to i

31、nfluence its risk profile.Risk AssessmentAllows an entity to understand the extent to which potential events might impact objectives.Assesses risks from two perspectives likelihood and impact.Normally assesses risks using the same unit of measure as that used to measure the related objectives.Employ

32、s a combination of both qualitative and quantitative risk assessment methodologies. Relates the time horizons to objective time horizons.Assesses risk on both an inherent and residual basis.Risk ResponseIdentifies and evaluates possible responses to risk. Evaluates options in relation to entitys ris

33、k appetite, cost vs. benefit of potential risk responses and degree to which a response will reduce impact and/or likelihood. Selects and executes its response based on evaluation of the portfolio of risks and responses.Assessment of and response to risks are integral components of ERM; which specif

34、ic response is selected is not. Control ActivitiesControl activities are the policies and procedures that help ensure that the risk responses, as well as other entity directives, are carried out.Occur throughout the organization, at all levels and in all functions. Includes application controls and

35、general information technology controls.Information and CommunicationInformation is needed at all levels of an entity in identifying, assessing, and responding to risk. Management identifies, captures and communicates pertinent information in a form and timeframe that enables people to carry out the

36、ir responsibilities. Communication occurs in a broader sense, flowing down, across and up the organization. MonitoringMonitors the ongoing effectiveness of the other enterprise risk management components through Ongoing monitoring activitiesSeparate evaluationsA combination of the two 37下属各子公司各条业务线各

37、职能部门整个公司YXZ战略目标经营目标报告目标合规目标内部环境目标设定事项识别风险评估风险应对控制活动信息与沟通监控General Risk CategoriesHazard/Legal RisksFinancial RisksOperational RisksStrategic RisksHazard Risk 灾难风险Hazard risk The possibility that an event will cause harm to an individual (by the organization) or that harm is done to the organization.

38、 Including risks from:fire and other property damage; windstorm and other natural perils; theft and other crime, personal injury; business interruption; disease and disability (including work-related injuries and diseases);liability claims; war and terrorismFinancial Risk 金融风险Financial risk Risks re

39、sulting from financial matters in the long or short term.Including risks from:Price (e.g. asset value, interest rate, commodity);Liquidity (e.g. cash flow, call risk, opportunity cost);Credit (e.g. default, downgrade);Inflation/purchasing power;Hedging/basis risk,Taxes; andCurrency fluctuations.Oper

40、ational Risk 运营风险Operational risk Risks resulting from a failure or event relative to day-to-day operations. Including risks from:Business operations (e.g., human resources, product development, capacity, efficiency, product/service failure, channel management, supply chain management, business cycl

41、icality, demand for services);Empowerment (e.g., leadership, change readiness);Information technology (e.g., relevance, availability);Information/business reporting (e.g., budgeting and planning, accounting information, pension fund, investment evaluation, taxation);National disaster;Failure to iden

42、tify market trends; andFailure to properly document deals and transactions. Strategic Risk 战略风险Strategic risk Risks resulting from events that affect the broad, overarching goals of the organization. Including risks from:Reputational damage (e.g., trademark/brand erosion, fraud, unfavorable publicit

43、y);Competition;Customer wants;Demographic and social/cultural trends;Technological innovation;Capital availability; andRegulatory and political trends.Imaginary Motors RisksHazard/Legal RisksPropertyBusiness InterruptionCargo/MarineWorkers compensationAutomobile LiabilityGeneral LiabilityProduct Lia

44、bilityEmployment PracticesCrimeBoiler & MachineryDirectors & OfficersIntellectual PropertyProduct RecallForeign LiabilityE&O/Professional LiabilityImaginary Motors RisksFinancial RisksCreditResidual ValueERISA/FiduciaryForeign ExchangeCommodity PricesEnergy PricesInterest RatesOperational RisksWarra

45、ntyProduct RecallContingent Business InterruptionPoliticalIntellectual PropertyE-CommerceStrike/Labor RelationsImaginary Motors Risks Strategic RisksModel SelectionGeographic ExpansionBrand ImageProduct PricingR&D InvestmentsAcquisitions & DivestituresAggregate Risk Management 综合风险管理Hazard Risk Hurr

46、icanes 飓风 Lawsuits 法律纠纷 Injuries 工伤Financial Risk Credit Risk 信用 Market Risk 市场 Interest Rates 利率Operational Risk Internal Fraud 内部舞弊 Recalls 召回Strategic Risk Regulation 法规 Reputation 声誉 Competition 竞争47Topic 2: Level of risk managementLEARNING OBJECTIVE Describe board, management and employee respo

47、nsibilities in managing risk. (Level 2)Required readingNo required readingwho is responsible for risk managementall members of an organization are responsible for identifying and managing risk.However, different levels of the organization have different responsibilities when it comes to monitoring,

48、reporting, and communicating risk.Board of directorsBe aware of significant risks, and the impact on the organization, shareholders, and other stakeholders.Make the risk management policy, as well as the strategy for risk management and operational actions for mitigating specific risks, clear and we

49、ll known.Communicate to stakeholders about risks and mitigation strategies.Be aware of the nature, probability, and consequence of significant risks.Develop and make clear the risk tolerance (appetite) of the organizationUnderstand the costs and benefits of taking on more (or less) risk.ManagerBe aw

50、are of risks in their area of responsibility and understand the impact on other segments of the organization.Develop and monitor key performance indicators for monitoring risk in their area of control.Develop communication systems for the board and subordinates to ensure the proper flow of informati

51、on about risk awareness, monitoring, and management.Develop effective reporting methods to communicate risk levels to the appropriate stakeholders (employees, board members, or regulators), as business segments are primarily responsible for regular risk monitoring.Help to develop and be familiar wit

52、h risk management strategies.EmployeesUnderstand the risks for which they are accountableReport systematically on risk monitoringBe familiar with risk management techniques企业风险管理框架（安永）一个基础：公司治理。三道防线：业务单位、风险管理单位、内审单位管理层CEO第三道防线第二道防线第一道防线业务部门董事会风险管理内部审计审计委员会风险管理委员会Risk Management Organizational Struct

53、ureBoard Risk Review Committee Requires management to identify and review the major areas of risk Approves and reviews compliance with the policies implemented by the CompanyExecutive Risk CommitteeProvides oversight of risk globally Approves and reviews compliance with risk policiesMonitors breache

54、s of risk tolerance limits and directs actionSponsors review and analysis on risk exposures related to specific issuesChief Risk OfficerDevelops and coordinates the Companys enterprise risk management frameworkReports to the CFO, Responsible for managing all aspects of riskEnterprise Risk Mgmt. Comm

55、itteeComprised of the chief risk officer, other corporate functional heads and the country risk leaders from the main operationsMeets monthly and reports into the ERCThe audit committee responsible for setting policy and developing plans for risk management. responsible for developing an awareness o

56、f possible risks. for monitoring and resolving risks, and to design and review processes for risk management and mitigation/resolution.54Identify the risksEvaluate the riskDecision “to act or not”Mitigate the riskMonitor and re-evaluate the riskThe basic steps of risk management55Topic 3: Evaluating

57、 riskLEARNING OBJECTIVE Summarize how risk is evaluated. (Level 2)Required readingNo required readingRisk Register“The Worksheet”How risk is evaluatedTime When will the consequences be felt and how long will their impact be a material factor for the firm?.Harm/benefit Take the time to analyze all th

58、e detrimental and possibly beneficial effects of an event. Cost/benefit apply financial models as well as qualitative assessments of the outcome of a particular eventPeople and resources Consider the event and the recovery in terms of the people and resources that will be affected.Sources that will

59、be affected These may include the originating factor of the risk and where the outcome of an event will occur.Risk Evaluation Tool Risk Matrix (风险矩阵图) A Risk Matrix is a matrix that is used during Risk Assessment to define the various levels of risk as the product of the harm probability categories

60、and harm severity categories. This is a simple mechanism to increase visibility of risks and assist management decision making.Impact vs. ProbabilityControlShareMitigate & ControlAcceptHigh RiskMedium RiskMedium RiskLow RiskLowHighHighIMPACTPROBABILITYExample: Call Center Risk AssessmentLowHighHighI