A Risk-Based Approach
To Implementing COSO
The COSO Framework
The Internal Control Process
Define
Define Assess
Assess Evaluate
Evaluate
Objectives
Objectives Risks
Risks Controls
Controls
2 Source: [Link]
The COSO Framework
The Internal Control Process
Define
Define Assess
Assess Evaluate
Evaluate
Objectives
Objectives Risks
Risks Controls
Controls
3 Source: [Link]
COSO Does Not Answer
the Question:
HOW DO WE IMPLEMENT THE
FRAMEWORK?
4 Source: [Link]
A Risk-Based Approach: The Business Risk Management Process
Purpose: Minimize the potential impact of the organization’s risks on the objectives and
strategies for creating and increasing shareholder/owner value
Establish Goals & Objectives
• Risk Limits • Risk Tolerance
Assess Business Risks
• Identify • Source • Measure
Develop Business Risk
Information Management Strategies •
• Avoid
Improve Business Risk for Price
Management Process Decision- • Transfer •
Making Accept
Monitor Business Risk Design/Implement
Management Process Risk Control Processes
Performance
5 Source: [Link]
Business Risk Management Process
Establish Goals & Objectives
1. Define the organization’s risk management goals and objectives
─ Business risk management process (BRMP)
─ Risk tolerances/boundaries/limits
Assess Business Risks
2. Evaluate changes in the environment, in key assumptions underlying business strategies and in business lines,
products and business processes and the impact of these changes on potential risks to the entity.
3. Implement processes or activities to assess business risks and information and information processing risks
(identify, source, measure) at the business process/activity level.
Information
Improve Business Risk for Decision-Making Develop Business Risk
Management Process 9. Ensure there is adequate
Management Strategies
communication and information for
8. Ensure that risk assessment, control 4. Respond to significant new risks or
decision-making
and monitoring processes/activities are ─ Enabling senior management changes in significant risks with
continuously improved throughout the to know that all BRMP appropriate strategies, and initiate the
organization. activities are performed as processes/activities to implement new
intended risk management strategies quickly.
─ Enabling risk managers and
process/ activity owners to
clearly understand their
responsibilities and
accountabilities
Monitor Business Risk Design/Implement Risk Control Processes
Management Process Performance
5. Ensure risk managers and process/activity owners:
7. Measure/monitor/assess the performance effectiveness of the BRMP ─ Have the requisite skills and expertise to design and implement
in: risk control processes/activities (commensurate with the risk
─ Identifying and managing specific risks and in executing management strategies).
strategies to create value (including the utilization of all available ─ Assume responsibility for and understand their accountability for
“audit” opportunities). managing significant risks.
─ Benchmarking against competitors and best practices 6. Assess the timeliness, efficiency and effectiveness of the design of
new or improved risk control processes.
6 Source: [Link]
Business Risk Model
• Establishes a common risk language
• Facilitates the risk identification process
• Contributes to building a risk-sensitive culture
• Facilitates the assessment of control effectiveness and
efficiency based on risk exposure
7 Source: [Link]
Protiviti Risk Model: A Common Language
E N V I R O N M E N T R I S K
Competitor Sensitivity Shareholder Relations Capital Availability
Catastrophic Loss Sovereign/Political Legal Regulatory Industry Financial Markets
P R O C E S S R I S K
EMPOWERMENT RISK
Leadership FINANCIAL RISK
OPERATIONS RISK Authority/Limit
Customer Satisfaction Outsourcing Interest Rate
Human Resources Performance Incentives Currency
Product Development Change Readiness Price Equity
Efficiency Communications Commodity
Capacity Financial Instrument
Performance Gap INFORMATION PROCESSING/
Cycle Time TECHNOLOGY RISK Cash Flow
Sourcing Relevance Opportunity Cost
Obsolescence/Shrinkage Integrity Liquidity
Concentration
Compliance Access
Business Interruption Availability Default
Product/Service Failure Infrastructure Concentration
Environmental Credit Settlement
INTEGRITY RISK
Health and Safety Collateral
Management Fraud
Trademark/Brand Name Erosion
Employee Fraud
Illegal Acts
Unauthorized Use
Reputation
INFORMATION FOR DECISION MAKING RISK
STRATEGIC
FINANCIAL
Environmental Scan
OPERATIONAL Budget and Planning
Business Portfolio
Pricing Accounting Information
Valuation
Contract Commitment Financial Reporting Evaluation
Performance Measurement
Performance Measurement Taxation
Organization Structure
Alignment Pension Fund
Resource Allocation
Regulatory Reporting Investment Evaluation
Planning
Regulatory Reporting
Life Cycle
8 Source: [Link]
Matching The COSO Control Objectives With The Business Risk
Model
COSO CONTROL OBJECTIVES OTHER OBJECTIVES
Financial Management
Operations Compliance Safeguarding Reporting Reporting Strategic
Environment Risk
Operations Compliance
Risk* Risk
R
B I
Financial Risk Financial Risk
U S
S K
Empowerment Risk
I
N M Information Processing/Technology Risk
E O
S D Integrity Risk
S E
L IFDM Risks- Financial
IFDM Risks- Strategic
IFDM Risks-
Operational
* Excludes Compliance Risk,
Which is Included Separately
9 Source: [Link]
Managing Business Risks: An Integrated Approach
CONTINUOUSLY ASSESS BUSINESS RISK
Reject “The Five A’s” of Risk Management
Unacceptable • Assess risk
Identify At Existing • Accept or reject risk
Level of Risk
• Avoid risk, transfer risk or reduce
Source Continuously
risk to an acceptable level
Risk/Reward If Pricing is • Analyze performance gaps
Balance Monitor Sufficient
Decision • Act to improve
Measure
If Risk is
Transferred
Acceptable Three Elements of Integrated Process
If Risk is
Accept
Reduced to an The Organization:
Acceptable • Speaks a common business risk
Level language
• Has a control structure that keeps it in
touch with reality and aligns business
15 Warning Signs of Ineffective risk management strategies with that
Business Risk Management reality
• Implements effective processes to
• No linkage of risk to value execute its business risk management
• No effort to anticipate strategies
• Ineffective strategic control
• No business risk policy
• No risk management “owners” CONTINUOUSLY ASSESS BUSINESS RISK MANAGEMENT STRUCTURE AND PROCESSES
• Not a priority
• No common risk language Yes Continuously
• No integrated risk assessment framework Assess by
• Unmanaged “trust positions” Business Risk Comparing to
Structure and Best Practices
• Fragmentation Design and Install
Processes to Identify
• Narrow focus In Place? Business Risk
No and Close
• More from less Structure and
Performance
• Poor risk communications Process
Gaps
• Too little, too late
• Poor segregation of incompatible duties
10 Source: [Link]
Business Self-Assessment
• Involves managers and process owners
• Supports continuous assessment of risk, risk
manageability and risk tolerance
• Supports continuous assessment of risk controls
(control activities) effectiveness and efficiency
• Supports four-way communications and information
sharing
• Provides a monitoring tool
• Leads to risk management improvement
opportunities
11 Source: [Link]
Business Self-Assessment Risk Map
How big are the potential adverse consequences? How likely is it that the adverse
consequences will occur?
3. High: Pervasive
(extremely material)
to extraordinary
(survival-threatening)
2. Medium: Important
(material) to serious
Significance (very material)
(How Big?)
3. Low: Very small
(inconsequential) to
small (immaterial)
1. Low: Very unlikely
2. Medium: Somewhat
(practically 3. High: Very likely to
possible to quite
impossible) to virtually certain
possible
remotely possible
Likelihood
(How Likely?)
12 Source: [Link]
Taking COSO to the Next Level
COSO is a great step forward, but a risk-based approach takes it to the next level by:
• Establishing a common business risk language.
• Facilitating the establishment of a risk-sensitive
culture.
• Providing assurance that all relevant business
risks are identified.
• Incorporating strategic business objectives into
the risk management process.
• Providing a flexible approach to evaluating or
designing business risk controls.
13 Source: [Link]
Taking COSO to the Next Level
• Strengthening the focus on assessing business
risks as the basis for improving business risk
controls.
─ Measuring risk exposure and cost of control
─ Closing the risk control performance gap
─ Eliminating unnecessary controls
• Addressing risks pertaining to the relevance and
reliability of internal, as well as, external reporting.
14 Source: [Link]
