INTERNAL CONTROL AND

RISK MANAGEMENT
 PROCESS

ESSENTIAL CONCEPTS EFFECTED BY TCWG, MNGMT COMPONENTS (CRIME)

& OTHER PERSONNEL
PREVENT/DETECT/CORRECT PROBLEMS
REASONABLE ASSURANCE
INHERENT LIMITATIONS: CAN’T ELIMINATE
ACHIEVEMENT OF ENTITY’S ATTITUDE, AWARENESS, ACTIONS
MATERIAL MISSTATEMENTS DUE TO FRAUD/
OBJECTIVES OF MNGMT & TCWG OF IC
ERROR
GOVERNANCE & MNGMT FUNCTIONS;
(F): RELIABILITY OF FINANCIAL REPORTING
SETS TONE OF ORGANIZATION
(O): ENHANCE EFFECTIVENESS &
ACHIEVE ENTITY’S OBJECTIVES EFFICIENCY OF OPERATIONS CREATED & MAINTAINED CULTURE
(C): ENTITY’S COMPLIANCE W/ RULES & OF HONESTY & ETHICAL BEHAVIOR
REGULATIONS STRENGTHS PROVIDE FOUNDATION
CONTROL AUDITOR: OBTAIN UNDERSTANDING FOR OTHER COMPONENTS OF IC
ENVIRONMENT & EVALUATE
OTHER COMPONENTS OF IC NOT
RELIABILITY FINANCIAL INFO (DECISION-MAKING PURPOSES) UNDERMINED BY CONTROL
ENHANCES E&E OF OPERATIONS ENVIRONMENT WEAKNESSES
BENEFITS STRONG IC
ASSURES COMPLIANCE W/ LAWS & REGULATIONS
PROTECTION OF ASSETS/DOCUMENTS/RECORDS INTEGRITY & ETHICAL VALUES
REDUCED COST (EXTERNAL AUDIT): AUDITOR MAY RELY ON IC MANAGEMENT PHILOSOPHY & OPERATING STYLE
ACTIVE PARTICIPATION OF TCWG
FACTORS REFLECTED COMMITMENT TO COMPETENCE
(IM A CPA)
(F): ACHIEVE RELIABILITY PERSONNEL OR HR POLICIES & PROCEDURES
OBJECTIVES (O): ACHIEVE OPERATIONAL EFFECTIVENESS ASSIGNMENT OF AUTHORITY & RESPONSIBILITY/
ORGANIZATIONAL STRUCTURE
(C): ACHIEVE COMPLIANCE
CLASSIFICATION
(CONTROLS)
INTERNAL PREVENTIVE: DETER PROBLEMS BEFORE ARISE
TECHNOLOGICAL DEVELOPMENTS
CONTROL FUNCTIONS DETECTIVE: DISCOVER/DETECT PROBLEMS AS ARISE BUSINESS RISK: RISK ENTITY’S BUSINESS
OBJECTIVES NOT ATTAINED AS RESULT OF CHANGES IN CUSTOMER’S DEMAND
(PDC) CORRECTIVE: REMEDY PROBLEMS DISCOVERED
INTERNAL & EXTERNAL FACTORS STED) OTHER ECONOMIC CHANGES

RISK ASSESSMENT
IDENTIFYING BUSINESS RISK
CONTROL ENVIRONMENT AUDITOR: OBTAIN UNDERSTANDING ESTIMATING SIGNIFICANCE OF RISK
RISK ASSESSMENT (EXISTENCE PROCESS) ASSESSING LIKELIHOOD OF OCCURENCE
INFORMATION & COMMUNICATION SYSTEMS ACTIONS TO ADDRESS RISKS
COMPONENTS
(CRIME) CONTROL ACTIVITIES
MONITORING
INQUIRIES EFFECTIVE IC PROVIDE TIMELY INFO & COMMUNICATION
INSPECTION (DOCS &
EVALUATE DESIGN INITIATIVE
RECORDS)
UNDERSTANDING IC: OBTAIN RECORD
OBSERVATION (ACTIVITIES PROCEDURES & RECORDS ENTITY
SUFFICIENT UNDERSTANDING INFO SYSTEM PROCESS
& OPERATIONS) ESTABLISHED TO TRANSACTIONS
OF COMPONENTS RELEVANT
REPORT
TO AUDIT IMPLEMENTATION
ASSETS
MAINTAIN LIABILITY
INFORMATION AND ACCOUNTABILITY
EQUITY
COMMUNICATION
NOT NEED PARTICULAR FORM SYSTEMS
DOCUMENT AUDITOR’S PROVIDE UNDERSTANDING INDIVIDUAL
UNDERSTANDING IC EXTENT VARIES: ENTITY SIZE & COMMUNICATION ROLES & RESPONSIBILITIES PERTAINING
COMPLEXITY AND NATURE OF IC SYSTEM TO IC OVER FINANCIAL REPORTING

PRELIMINARY ASSESSMENT: HIGH LEVEL (100%) CLASSES OF TRANSACTIONS

OR > HIGH LEVEL PROCEDURES: IT & MANUAL SYSTEMS
CONSIDERATION ASSESSMENT
CONTROL RISK (CR) IC NOT EFFECTIVE = CR HIGH LVL RELATED ACCTG. RECORDS, SUPPORTING
AUDITOR: OBTAIN UNDERSTANDING INFO & SPECIFIC ACCOUNTS IN F/S
IC RELIABLE = CR LOW LVL (EVIDENCE; JUSTIFY)
RECORDS EITHER MANUAL/
METHODS & RECORDS ELECTRONIC FORM
PERFORMED TO OBTAIN DESIGN ACCTG. & IC SYSTEM IDENTIFY & RECORD ALL VALID TRANSACTIONS
EVIDENCE (CR LOW LVL) OPERATION IC DESCRIBE ON TIMELY BASIS TRANSACTIONS:
PERFORM TEST OF PROPER CLASSIFICATION
CONTROLS (ToC) MEASURE VALUE OF TRANSACTIONS:
INQUIRY PROPER MONETARY VALUE
NATURE (EVIDENCE OBSERVATION TIME PERIOD TRANSACTIONS OCCURRED:
GATHERING PROCEDURES)
COMMUNICATION OF IC WEAKNESS INSPECTION RECORD PROPER ACCTG. PERIOD
REPERFORMANCE
AUDITOR’S REQUIRED TO REPORT AT PRESENT PROPERLY TRANSACTIONS
APPROPRIATE LEVEL OF MANAGEMENT MATERIAL & RELATED DISCLOSURES
WEAKNESS IN DESIGN/OPERATION OF ACCTG. &
IC SYSTEMS WHICH COME TO ITS ATTENTION
CR: HIGH LVL = DOCUMENT CR HIGH LVL
DOCUMENT ASSESSED
LEVEL OF CR CR: > HIGH LVL = DOCUMENT CR > HIGH LVL + EVIDENCE
(BASIS; FR ToC)
 POLICIES & PROCEDURES: ENSURE MNGMT
MODEL IMPLICATIONS
DIRECTIVES ARE CARRIED OUT REVIEWS & ANALYSES OF ACTUAL PERFORMANCE VS.
BUDGETS, FORECAST & PRIOR PERIOD PERFORMANCE
PERFORMANCE REVIEWS
RELATING DIFFERENT SETS OF DATA, ANALYSIS
IMPACT RISK MANAGEMENT ACTIONS
CONTROL RELATIONSHIP & INVESTIGATIVE & CORRECTIVE ACTIONS
SIGNIFICANT RM REQUIRED MANAGE & MONITOR RISK EXTENSIVE MANAGEMENT OF RISK
ACTIVITIES
INTERNAL CONTROL PROCEDURES:
INFORMATION PROCESSING MODERATE MONITORING MANAGEMENT EFFORT MANAGEMENT EFFORT REQUIRED
GENERAL & APPLICATION CONTROL
SPECIFIC CONTROL PROCEDURES
(PIPS) SECURED FACILITIES MINOR ACCEPT RISKS ACCEPT BUT MONITOR MANAGE & MONITOR
PHYSICAL SECURITY & ADEQUATE
PHYSICAL CONTROLS AUTHORIZATION FOR ACCESS
SAFEGUARDS OF ASSETS
PERIODIC COUNTING LIKELIHOOD OF
LOW MEDIUM HIGH
OCURRENCE
AUTHORIZATION
SEGREGATION OF DUTIES DIFFERENT PEOPLE RECORDING
CUSTODY
RISK GREAT & CAN’T BE CONTAINED/COST OF
TERMINATE
CONTAINMENT PROHIBITIVE
PROCESS: ASSESSING QUALITY OF
CONTROLS MEASURES TO MITIGATE IMPACT/ELIMINATE RISK
IC PERFORMANCE OVER TIME

ASSESSING DESIGN & OPERATION TELL SOMEONE PARTY WHO CAN TACKLE IT BEST
OF CONTROLS ON TIMELY BASIS &
TAKING NECESSARY CORRECTIVE
MONITORING TRANSFER STRATEGY OF SPREADING RISK
ACTIONS

NORMAL RECURRING ACTIVITIES/ REGULAR MNGMT & SUPERVISORY COMMUNICATE

ONGOING MONITORING COMMUNICATE RISKS TO STAKEHOLDERS & MAKE THEM AWARE
ACTIVITIES (PREPARATION OF MONTHLY BANK RECONCILIATION RESPONSE
ACCOMPLISHED THRU PERFORMED ON NON-ROUTINE BASIS (FUNCTIONS PERFORMED BY AREAS WHERE CONTROLS CRUCIAL TO MITIGATING SIGNIFICANT
SEPARATE EVALUATIONS CHECK COMPLIANCE
INTERNAL AUDITORS) RISKS & ENSURE WORKING AS INTENDED

BOTH DECISION IS BASED ON IN-DEPTH RESEARCH: RISK, ITS

COMMISSION RESEARCH
IMPACT & PROBABILITY

CONTINGENCY MEASURES AFTER PREVENTIVE CONTROL FAIL

UNCERTAINTY OF OUTCOME W/IN RANGE OF EXPOSURES ARISING FROM MAXIMIZING AREAS: CONTROLS OVER OUTCOME
TAKE MORE
COMBINATION OF IMPACT & PROBABILITY OF POTENTIAL EVENTS MINIMIZING AREAS: NO/LIMITED CONTROL
RISK
IMPACT ON ACHIEVEMENT OF OBJECTIVES TOLERATE CONTINUOUS ASSESSMENT & MONITORING OF RISKS TO
MAINTAIN LOW IMPACT & LIKELIHOOD OF HAPPENING

DYNAMIC PROCESS TAKING ALL REASONABLE STEPS TO FIND ACCTG. & REPORTING
OUT & DEAL WITH RISK THAT IMPACT OBJECTIVES MARKET
RESPONSE TO RISK & DECISIONS MADE IN RESPECT OF AVAILABLE FINANCIAL LIQUIDITY
DEFINITION CHOICES & RESOURCES TAX
TASK: DEFINING/IDENTIFYING/ASSESSING RISK FOR IMPACT & MATERIALITY CAPITAL STRUCTURE
AND DEVISING SUITABLE WAYS FOR DEALING WITH MORE SIGNIFICANT RISKS
PLANNING & RESOURCE ALLOCATION
COMMUNICATIONS & INVESTOR RELATIONS
REALISTIC BUSINESS & PROJECT PLANNING MAJOR INITIATIVES & CAPITAL PROGRAMS
STRATEGIC
ACTIONS IMPLEMENTED IN TIME RISK COMPETITIVE MARKET DYNAMIC
CERTAINTY OF ACHIEVING BUSINESS GOALS & PROJECT OBJECTIVES CLASSIFICATION MERGERS, ACQUISITIONS & DIVESTITURES
BENEFITS APPRECIATION & READINESS TO EXPLOIT ALL BENEFICIAL OPPORTUNITES MACRO-MARKET DYNAMICS
LOSS CONTROL
CONTROL OF PROJECT & BUSINESS COSTS GOVERNANCE
INCREASED FLEXIBILITY (UNDERSTANDING ALL OPTIONS & ASSOCIATED RISKS) REGULATORY
COMPLIANCE
FEWER COSTLY SURPRISES (EFFECTIVE & TRANSPARENT CONTINGENCY PLANNING) LEGAL
RISK CODE OF CONDUCT
MANAGEMENT
(RM) INFO TECH
IDENTIFYING ALL RISKS; ALL IMAGINABLE RISKS = IDENTIFIED & RECORDED PHYSICAL ASSETS
IDENTIFICATION SALES & MARKETING
INVOLVES ALL PARTIES W/ EXPERTISE, RESPONSIBILITY & INFLUENCE OVER OPERATIONAL PEOPLE
AREA AFFECTED BY RISKS QUESTIONS
R&D
SUPPLY CHAIN
ASSESS SIGNIFICANCE OF RISKS IDENTIFIED
STAGES ASSESSMENT HAZARDS
(RAMI) 2 CONSIDERATION: IMPACT & LIKELIHOOD

MANAGEMENT W/ KNOWLEDGE WHAT RISKS ARE SIGNIFICANT ROLES OF IA IN RM

REVIEW RM PROCESS & OUTPUTS: REVIEWED & REVISITED ON CONTINUAL BASIS REVIEW EXTENT MANAGERS & BOARD MONITOR EFFECTIVENESS OF SYSTEM
MEMBERS IDENTIFIED/EVALUATED/ OF IC INTRODUCED TO ADDRESS
MANAGED COMPANY’S RISK SIGNIFICANT RISKS
RM PROCESS
COMPONENTS RISK STRATEGY
RM FUNCTION
 STRUCTURED/CONSISTENT/CONTINUOUS VEHICLE FOR CAPTURING ALL ASSESSMENT & DECISIONS MADE IN
PROCESS ACROSS WHOLE ORG. RESPECT OF IDENTIFIED RISKS
DEFINITION RISK REGISTERS
IDENTIFYING/ASSESSING/DECIDING RESPONSE & REPORTING ON OPPORTUNITIES & MAY FORM PART OF ASSURANCE PROCESS WHERE USED AS EVIDENCE
THREATS AFFECTING ACHIEVEMENT OF ORG. OBJECTIVES OF RISK CONTAINMENT ACTIVITY W/C SUPPORTS STATEMENT OF IC

DEFINES HOW WE SEE RESIDUAL RISK AFTER DEALT W/ IT THRU APPROPRIATE

RESPONSIBILITY BOARD OVERALL RESPONSIBILITY ENSURING RISKS ARE MANAGED RISK APPETITE STRATEGY WHETHER ACCEPTABLE OR NOT (RISK ACCEPTABLE/NEED TO DO
MORE TO CONTAIN/EXPLOIT AREAS RISK TOO LOW)
DELEGATE OPERATION RM FRAMEWORK TO MNGMT TEAM
(RESPONSIBLE FOR COMPLETING RM ACTIVITIES)
EACH PART OF ORG. UNDERTAKE RISK ASSESSMENT & COMPILE RISK
REGISTERS CONTAINING AGREED RM STRATEGY
RISK SCORING
LIKELIHOOD OF ACHIEVING ORG. OBJECTIVES
REPORTS ACTIVITIES
ENTERPRISE-WIDE RISK CONSOLIDATED REPORTING DISPARATE RISKS AT BOARD LEVEL
MANAGEMENT (ERM) UNDERSTANDING OF KEY RISKS & WIDER IMPLICATIONS RISK RATING CODE
EASY IDENTIFICATION & SHARING OF CROSS BUSINESS RISKS OWNER & ACTION REQUIRED USING SUITABLE REPORTING TOOL

BENEFITS MANAGEMENT FOCUS ON ISSUES RLLY MATTER

FEWER SURPRISES/CRISES HIGH RISK: URGENT BOARD LVL REPORTS & ON-GOING MONITORING
FOCUS INTERNALLY DOING RIGHT THINGS THE RIGHT WAY MAJOR RISK: DIRECTOR INVOLVEMENT & RAPID REVIEW
LIKELIHOOD CHANGE INITIATIVES BEING ACHIEVED SIGNIFICANT RISK: MANAGER INTERVENTION & SUMMARY BRIEFING TO DIRECTOR
MODERATE RISK: BASIC MNGMT PRACTICE APPLIED
ENHANCE CAPABILITY: GREATER RISK FOR GREATER REWARD
INFORMED RISK-TAKING & DECISION MAKING

RM PROCESSES: BOTH DESIGN & FUNCTIONS

IA PROVIDE MANAGEMENT OF IDENTIFIED RISKS & EFFECTIVENESS OF CONTROLS
ASSURANCE
RELIABLE & APPROPRIATE RISK ASSESSMENT & REPORTING

REVIEWING MNGMT KEY RISKS

EVALUATING KEY RISK REPORT

CORE IA ROLE RM PROCESSES
RISKS CORRECTLY EVALUATED
GIVING ASSURANCE
RM PROCESSES

IDENTIFICATION & EVALUATING RISKS

COACHING MANAGEMENT RESPONDING TO RISKS
COORDINATING ERM ACTIVITIES
LEGITIMATE IA ROLES CONSOLIDATED RISK REPORT
W/ SAFEGUARD
MAINTAINING & DEVELOPING ERM FRAMEWORK
CHAMPIONING ESTABLISHMENT OF ERM
DEVELOPING RM STRATEGY FOR BOARD APPROVAL
ROLE OF INTERNAL
AUDITING ON ERM

CLEAR MNGMT RESPONSIBLE TO RM

NATURE OF IA’S RESPONSIBILITIES BE DOCUMENTED IN INTERNAL

AUDIT CHARTER & APPROVED BY AUDIT COMMITTEE

IA NOT MANAGE RISKS ON BEHALF OF MNGMT

SAFEGUARDS
IA PROVIDE ADVICE/CHALLENGE/SUPPORT MNGMT’S DECISIONS

IA CANNOT GIVE OBJECTIVE ASSURANCE ON ANY PART OF ERM

FRAMEWORK W/C IT’S RESPONSIBLE
WORK BEYOND ASSURANCE ACTIVITIES BE RECOGNIZED AS CONSULTING
ENGAGEMENT & IMPLEMENTATION STANDARDS RELATED TO SUCH BE
FOLLOWED

SETTING RISK APPETITE

IMPOSING RM PROCESSES
ROLES IA SHOULD NOT TAKING MNGMT ASSURANCE ON RISKS
UNDERTAKE TAKING DECISIONS ON RISK RESPONSES
IMPLEMENTING RISK RESPONSE ON MNGMT’S BEHALF
ACCOUNTABILITY FOR RM

IA SHOULD REPORT TO BOD TO MAINTAIN OUR INDEPENDENCE