‘Corporate governance failures and their impact: in the Institute of Internal Auditors— UK and Ireland Study Text’ Corporate Governance and Risk Management, Oct.. ‘Corporate governance f
Trang 1a directed and controlled.
b designed and administered
c directed and managed
d managed and developed
4 Which item is the least appropriate?
Cadbury went on to describe the underpinning principles behind the code:
a Openness
b Integrity
c Accountability
d Motivation
5 Which is the most appropriate sentence?
The Organisation for Economic Cooperation and Development has prepared an inclusiveset of corporate governance principles Principle number one:
a The corporate governance framework should promote transparent and efficient markets,
be consistent with the rule of law and clearly articulate the division of responsibilitiesamong different supervisory, regulatory and police authorities
b The corporate governance framework should promote transparent and efficient markets,
be consistent with management theory and clearly articulate the division of responsibilitiesamong different supervisory, regulatory and enforcement authorities
c The corporate governance framework should promote transparent and efficient markets,
be consistent with the rule of law and clearly articulate the division of responsibilitiesamong different supervisory, regulatory and enforcement authorities
d The corporate governance framework should promote transparent and failsafe markets,
be consistent with the rule of law and clearly articulate the division of responsibilitiesamong different supervisory, regulatory and enforcement authorities
6 Insert the missing words:
The Toronto Stock Exchange believes that good disclosures gives investors a solid standing of how are made that may affect their investment.
under-a investments
b decisions
c appointments
d losses
7 Which is the most appropriate sentence?
a Over in Australia, the Australian Stock Exchange issued legislation through its CorporateGovernance Council in 2003 to maintain an informed and efficient market and preserveinvestor confidence
b Over in Australia, the Australian Stock Exchange issued guidance through its CorporateGovernance Council in 2003 to maintain an informed and efficient market and preservegovernment confidence
c Over in Australia, the Australian Stock Exchange issued guidance through its RiskManagement Council in 2003 to maintain an informed and efficient market and preserveinvestor confidence
d Over in Australia, the Australian Stock Exchange issued guidance through its CorporateGovernance Council in 2003 to maintain an informed and efficient market and preserveinvestor confidence
Trang 28 Which is the odd one out?
The United States has been at the forefront in setting standards for regulating registeredcompanies The now famous Sarbanes-Oxley Act of 2002 set the benchmark for the newrules issued by the Securities and Exchange Commission (SEC) Chief Executive Officers andChief Finance Officers have to respond to a whole new raft of rules, including the need tocertify that:
a the financial statements and other financial information in the report on the condition andresults of the company are presented fairly in all material respects
b they have taken responsibility for the design and maintenance of disclosure controls andevaluated their effectiveness, presenting details of corrective actions they have taken
c they have disclosed to the audit committee and external auditors all significant deficiencies
in the design or operation of internal financial controls, and any fraudulent acts
d they have listed all those failed projects that indicate poor internal control
9 Which is the most appropriate sentence?
a External audit fits into the corporate governance jigsaw by providing a report on theperformance reports prepared by the board They check that these accounts show a trueand fair view of the financial performance of the company and its assets and liabilities atthe end of the accounting year
b External audit fits into the corporate governance jigsaw by providing a report on the finalaccounts prepared by the board They check that these accounts show a true and fairview of the financial performance of the company and its assets and liabilities at the end
of the accounting year
c External audit fits into the corporate governance jigsaw by providing a report on the finalaccounts prepared by the board They check that these accounts show a true and fairview of the financial performance of the company and its assets and staff at the end ofthe accounting year
d External audit fits into the corporate governance jigsaw by providing a report on the finalaccounts prepared by the auditors They check that these accounts show a true and fairview of the financial performance of the company and its assets and liabilities at the end
of the accounting year
10 Insert the missing words:
Many internal audit shops have a dotted line responsibility to the While
bearing this in mind, the internal auditor should also ensure there is a clear relationshipbetween the CAE and the executive board
1 Chambers, Andrew (2002) ‘Stakeholders— the court of public opinion’ in Corporate Governance Handbook,
Tolley’s, Reed Elsevier (UK) Ltd, p 627.
2 Daily Mail, 17 Jan 2002, p 75, ‘Tough guy rough is a hard act to follow’ (David Rough), City and Finance, The
City Interview by Cliff Feltham.
3 Weait, Mathew ‘The workplace ethic—is it a crime’ Management Today, Jan 2001, pp 53–55.
4 Daily Mail, Tuesday 23 Jan 2001, p 7, ‘Customers’ revenge’, Tozer James.
Trang 35 The Nolan Code (www.public-standards.gov.uk).
6 Harpur, Oonagh Mary, warningChief Executive of the Institute of Directors, ‘Promoting enterprise with integrity’.
Internal Auditing, Feb 2000, p 6.
7 Internal Auditing and Business Risk, Governance Responsibility Reporting, Moon, Chris Feb 2002, pp 36–37, Association of British Insurers Guidelines on Social, Ethical and Environmental (SEE) Issues—Investing in Social Responsibility— Oct 2001.
8 www.bodyshop.com.
9 www.tesco.co.uk.
10 Baker, Neil, ‘Ready to blow’ Internal Auditing and Business Risk, June 2002-09-24, pp 23–25.
11 Baker, Neil and Lea, Robert, ‘A fraud waiting to be detected’ Accountancy Age, 27 April 1995, p 10.
12 ‘Corporate governance failures and their impact: in the Institute of Internal Auditors— UK and Ireland Study
Text’ Corporate Governance and Risk Management, Oct 2002, p 18.
13 Daily Mail, Saturday 7 April 1996, p 17, ‘Five years jail for fugitive Nadir’s Miss Moneypenny’.
14 www.guardian.co.uk/Archive/Article, visited 15/12/2002.
15 ‘Corporate governance failures and their impact: in the Institute of Internal Auditors— UK and Ireland Study
Text’ Corporate Governance and Risk Management, Oct 2002, p 18.
16 ‘Corporate governance failures and their impact: in the Institute of Internal Auditors— UK and Ireland Study
Text’ Corporate Governance and Risk Management, Oct 2002, p 18.
17 Weekes, Tim, ‘The £5m lesson in swindling’ Accountancy Age, 22 June 1995.
18 Daily Mail, Saturday 15 June 1996, p 19, ‘Fall of King Copper’, Burt Jason.
19 www.guardian.co.uk/business, visited 15/12/2002.
20 www.guardian.co.uk/business, visited 15/12/2002.
21 Financial Mail on Sunday, 18 Oct 1998, p 15, ‘Inland Revenue ‘‘failures’’ in corruption case prompt call for
whistleblowers’ charter— taxman under fire over bribes scandal’.
22 Cooper, Cathy, ‘Management blasted at nuclear plant’ People Management, 16 March 2000, p 16.
23 Daily Mail, Wednesday 31 Jan 2001, p 2, ‘Agony of parents in babies scandal’ William David and Jenny Hope.
24 ‘Corporate governance failures and their impact: in the Institute of Internal Auditors— UK and Ireland Study
Text’ Corporate Governance and Risk Management, Oct 2002, p 19.
25 ‘Corporate governance failures and their impact: in the Institute of Internal Auditors— UK and Ireland Study
Text’ Corporate Governance and Risk Management, Oct 2002, p 19.
26 www.news.bbc.co.uk, visited 15/12/2002.
27 ‘Corporate governance failures and their impact: in the Institute of Internal Auditors— UK and Ireland Study
Text’ Corporate Governance and Risk Management, Oct 2002, p 19.
28 www.news.bbc.co.uk/1/hi/business, visited 15/12/2002.
29 www.news.bbc.co.uk/1/hi/business, visited 15/12/2002.
30 www.news.ft.com/servlet, visited 15/12/2002.
31 Cadbury Report, Report of the Committee on the Financial Aspects of Corporate Governance, 1992, para 2.5.
32 Cadbury Report, Report of the Committee on the Financial Aspects of Corporate Governance, 1992.
33 Rutteman Report, Internal Control and Financial Reporting: Guidance for Directors of Listed Companies Registered in the UK, 1994.
34 The Greenbury Report, Directors’ Remuneration: Report of A Study Group Chaired by Sir Richard Greenbury, 1995.
35 Turnbull Report, Guidance for Directors on the Combined Code, 1999.
36 Review of the Turnbull Guidance on Internal Control, Evidence Gathering Phase, Consultation Paper, Financial Reporting Council, Turnbull Review Group December 2004, pp 14 and 15.
37 OECD Principles of Corporate Governance
38 Corporate Governance, A guide to good disclosure, Toronto Stock Exchange, 2004
39 Australian Stock Exchange, Principles of Good Corporate Governance and Best Practice Recommendations, March 2003
40 Chambers Andrew (2002) ‘Stakeholders— the court of public opinion’ in Corporate Governance Handbook,
Tolley’s, Reed Elsevier (UK) Ltd p 12.
41 IIA Glossary of Terms.
42 IoD Factsheets, 8 July 2002, ‘What are the responsibilities and liabilities of the directors?’ (www.iod.co.uk).
Trang 443 IoD Factsheets, 8 July 2002, ‘What is the role of the NED?’ (www.iod.co.uk).
44 Daily Mail, City and Finance, 25 April 2002, p 69, ‘Pension champion who is scourge of fat cats’, Ruth Sunderland
interviewing Alan Rubenstein.
45 ‘ICAEW audit and assurance faculty’ Internal Auditing and Business Risk, Oct 2000, p 21.
46 www.the iia.org, visited 6 Dec 2002
47 Bolton, Gill, ‘Implementing Turnbull’ Internal Auditing, June 2000 (UK), p 36.
48 IIA Uk&Ireland — Local Government Auditing In England and Wales, 1998.
Trang 6MANAGING RISK
Introduction
The formal definition of internal auditing is repeated here as follows:
Internal auditing is an independent, objective assurance and consulting activity designed to addvalue and improve an organization’s operations It helps an organization accomplish its objectives
by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of riskmanagement, control and governance processes
We need to understand risk and we need to appreciate the importance of risk management to
an organization Good corporate governance codes require the board to install a system of riskmanagement and tell their shareholders about this system This chapter addresses the concept ofrisk We consider some of the material that has been written about risk and introduce the riskcycle as a way of understanding how risk management works We touch on important aspects
of the risk management system relating to risk policies and concepts such as enterprise-wide riskmanagement and control self-assessment The breakthrough into risk has impacted the internalauditor’s work and an important account of this move into a new phase of internal auditingwas provided in 1998 by David McNamee and Georges Selim, who defined three stages in thedevelopment of internal auditing:
1 counting and observing;
2 systems of internal control;
3 auditing the business process through a focus on risk
They go on to describe the paradigm shift that enables this leap from stage two to stage three,and argue that:
The implications of this paradigm shift are enormous It turns the focus of the audit away fromthe past and present and toward the present and future Focusing on controls over transactionsburied the internal auditor in the details of the past, limiting the value from any informationderived By focusing on business risks to present and future transactions, the auditor is working at
a level above the details and dealing with the obstacles for organisation success The informationderived from such exploration has great value to the management governance team.1
The emphasis on risk management now drives many larger organizations, not as a reportingrequirement, but as a powerful business tool that, used properly, improves performance In anattempt to get behind risk management we cover the following ground in this chapter:
3.1 What is Risk?
3.2 The Risk Challenge
3.3 Risk Management and Residual Risk
3.4 Mitigation through Controls
3.5 Risk Registers and Appetites
Trang 73.6 The Risk Policy
3.7 Enterprise-Wide Risk Management
3.8 Control Self-Assessment
3.9 Embedded Risk Management
3.10 The Internal Audit Role in Risk Management
Summary and Conclusions
Chapter 3: Multi-Choice Questions
3.1 What is Risk?
We need go no further than the work of Peter L Bernstein to get an insight into the quality
of risk:
The word ‘risk’ derives from the early Italian risicare, which means ‘to dare’ In this sense, risk is
a choice rather than a fate The actions we dare to take, which depend on how free we are tomake choices, are what the story of risk is all about And that story helps define what it means
to be a human being.2
This immediately introduces the concept of choice when it comes to risk Not simply beingsubject to risks as a part of life, but being in charge of one’s destiny as there is much that wecan control if we have the time and inclination to do so The stewardship concept underpinningcorporate governance forces management to seek out risks to the business and address them,where appropriate Peter L Bernstein goes on to suggest: ‘The capacity to manage risk, and with
it the appetite to take risk and make forward-looking choices, are the key elements of energy thatdrives the economic systems forward.’3
Throughout the chapter we will develop a model to consider risk and risk management Thefirst part of our first model appears as shown in Figure 3.1
•
•
RISKS
IMPACT
FIGURE 3.1 Risk management (1)
3.2 The Risk Challenge
The popular press is full of stories where things have gone terribly wrong It seems that themere act of walking out one’s door, or getting into a car, or jumping into a swimming pool canmean disaster, injury or even death We have said that controls are ways of minimizing risk anduncertainty and turning once again to Bernstein we can obtain a perspective of this concept ofcontrol: ‘But if men and women were not at the mercy of impersonal deities and random chance,
Trang 8they could no longer remain passive in the face of an unknown future They had no choice but
to begin making decisions over a far wider range of circumstances and over far longer periods oftime than ever before.’4
We arrive now at the view that risk represents a series of challenges that need to be met Also,the key feature of this challenge is that it appears when a major decision has to be made Riskhas no real form unless we relate it to our own direction, that is what we are trying to achieve
It is the risks to achieving objectives that affect us in that they detract from the focus on successand stop us getting to the intended result We may add to the risk model and incorporate thisfeature into the existing dimensions in Figure 3.2
•
•
RISKS
IMPACT OBJECTIVES
FIGURE 3.2 Risk management (2)
In this way the impacts become the effect the risks have on the objectives in hand Goodsystems of risk management keep the business objectives firmly in mind when thinking about risk.Poor systems hide the objectives outside the model or as something that is considered peripheral
to the task of assessing the impact of the risks In reality it is not as simple as this The act ofsetting objectives in itself is based on real and perceived risks, that is some uncertainty about thefuture In recognition of this, we can adjust slightly our risk model to make the risk componentinteractive —in that the objectives are themselves set by reference to the uncertainty inherent inorganizational climate in Figure 3.3
•
•
RISKS
IMPACT
FIGURE 3.3 Risk management (3)
The other concept that needs to be considered is that risk, in the context of achieving objectives,has both an upside and an downside In our model we call these threats and opportunities That
is, it can relate to forces that have a negative impact on objectives, in that they pose a threat.Upside risk on the other hand represents opportunities that are attainable but may be missed
or ignored, and so mean we do not exceed expectations This is why risk management is not
Trang 9really about building bunkers around the team to protect them from the outside world It is moreabout moving outside of familiar areas and knowing when and where to take risks This is quiteimportant in that if we view controls as means of reducing risk, we can now also view them
as obstacles to grasping opportunities So risk management is partly about getting in improvedcontrols where needed and getting rid of excessive controls where they slow proceedings downtoo much In other words, making sure controls are focused, worth it and make sense We canturn once more to Peter Bernstein for a view of where opportunity fits into the equation: ‘all ofthem (past writers) have transformed the perception of risk from chance of loss into opportunityfor gain, from FATE and ORIGINAL DESIGN to sophisticated, probability-based forecasts of thefuture, and from helplessness to choice.’5
The South African King report on corporate governance also acknowledges the two sides ofrisk by suggesting: ‘risk should not only be viewed from a negative perspective The review processmay identify areas of opportunity, such as where effective risk management can be turned tocompetitive advantage.’ The next point to address is the basic two dimensions of measuring risk.That is, as well as defining the impact of the risk, we need also to think about the extent to whichthe risk is likely to materialize To incorporate this feature into our risk model we need to add aseparate box that provides a grid of likelihood and impact considerations regarding the effect ofthe risk on the set objectives in Figure 3.4
FIGURE 3.4 Risk management (4)
Having established the two aspects of risk, we can start to think about which risks are notonly material, in that they result in big hits against us, but also whether they are just around thecorner or kept at bay Since risk is based on uncertainty, it is also based on perceptions of thisuncertainty and whether we have enough information to hand Where the uncertainty is caused
by a lack of information then the question turns to whether it is worth securing more information
or examining the reliability of the existing information Uncertainty based on a lack of informationthat is in fact readily available points to failings in the person most responsible for dealing with theuncertainty There is much that we can control, if we have time to think about it and the capacity
to digest the consequences
3.3 Risk Management and Residual Risk
Risk management is a dynamic process for taking all reasonable steps to find out and deal withrisks that impact on our objectives Organizational resources and processes are aligned to handle
Trang 10risk wherever it has been identified We are close to preparing the risk management cycle andincorporating this into our original risk model Before we get there we can turn to projectmanagement standards for guidance on the benefits of systematic risk management which include:
• More realistic business and project planning
• Actions implemented in time to be effective
• Greater certainty of achieving business goals and project objectives
• Appreciation of, and readiness to exploit, all beneficial opportunities
• Improved loss control
• Improved control of project and business costs
• Increased flexibility as a result of understanding all options and associated risks
• Fewer costly surprises through effective and transparent contingency planning.6
Before we can delve into risk management we need to make a further point, that is that riskmanagement is mainly dependent on establishing the risk owner, or the person most responsiblefor taking action in response to a defined risk, or type of risk, or risk that affects a particular process
or project The Turnbull report (see Chapter 2) on corporate governance for listed companiescontains the following provisions regarding risk management:
The reports from management to the board should, in relation to the areas covered by them,provide a balanced assessment of the significant risks and the effectiveness of the system ofinternal control in managing those risks Any significant control failings or weaknesses identifiedshould be discussed in the reports, including the impact that they have had, could have had, ormay have, on the company and the actions being taken to rectify them It is essential that there
be openness of communication by management with the board on matters relating to risk andcontrol (para 30)
When reviewing reports during the year, the board should:
• consider what are the significant risks and assess how they have been identified, evaluatedand managed;
• assess the effectiveness of the related system of internal control in managing the significantrisks, having regard, in particular, to any significant failings or weaknesses in internal controlthat have been reported;
• consider whether necessary actions are being taken promptly to remedy any significant failings
or weaknesses; and
• consider whether the findings indicate a need for more extensive monitoring of the system
of internal control (para 31)
The government position is found in the HM Treasury guidance on strategic risk managementwhich says: ‘The embedding of risk management is in turn critical to its success; it should become
an intrinsic part of the way the organisation works, at the core of the management approach; notsomething separated from the day to day activities.’ (para 9.1)
To summarize the risk management process we can turn again to the risk model in Figure 3.5.The stages of risk management are commonly known as:
Identification The risk management process starts with a method for identifying all risksthat face an organization This should involve all parties who have expertise, responsibility andinfluence over the area affected by the risks in question All imaginable risks should be identifiedand recorded Business risk is really about these types of issues, and not just the more well-knowndisasters, acts of God or risks to personal safety
Trang 11Assessment Management
Review
FIGURE 3.5 Risk management (5)
Assessment The next stage is to assess the significance of the risks that have been identified.This should revolve around the two-dimensional Impact, Likelihood considerations that we havealready described earlier
Management Armed with the knowledge of what risks are significant and which are less so,the process requires the development of strategies for managing high impact, high likelihood risks.This ensures that all key risks are tackled and that resources are channelled into areas of mostconcern, which have been identified through a structured methodology
Review The entire risk management process and outputs should be reviewed and revisited on
a continual basis This should involve updating the risk management strategy and reviewing thevalidity of the process that is being applied across the organization
The above cycle is simple and logical and means clear decisions can be made on the types ofcontrols that should be in place and how risk may be kept to an acceptable level, notwithstandingthe uncertainty inherent in the nature of external and internal risks to the organization In practice,the application of this basic cycle does cause many difficulties Most arise because we impose alogical formula on an organization of people, structures and systems that can be complicated,unpredictable, vaguely defined and perceived, emotive and in a state of constant change Mostrisk management systems fail because the process is implemented by going through the abovestages with no regard to the reality of organizational life Managers tick the box that states thestages have been gone through and eventually the board receives reports back that state riskmanagement has been done in all parts of the organization Our risk models will have to befurther developed to take on board the many intricacies that have to be tackled to get a robustand integrated system of risk management properly in place
3.4 Mitigation through Controls
We have suggested that risk management is an important part of the risk cycle, as it allows anorganization to establish and review their internal controls, and report back to the shareholdersthat these controls are sound The internal control framework consists of all those arrangements,and specific control routines and processes that drive an organization towards achieving objectives
In terms of risk management we need to add to our risk model to set out the types of response
Trang 12low high med low
Identification
Assessment Management
FIGURE 3.6 Risk management (6)
to risk that ensure we can remain in control Borrowing from the thinking of Peter Drucker, theseresponses consist of specific controls over processes and overall control over the delivery of theagreed strategy Our latest risk model becomes Figure 3.6
We have developed ten measures for addressing risks that have already been assessed forimpact and likelihood, in the bottom left box of our model Each of the ten responses (5Ts and5Cs) are numbered and can be located within the appropriate part of the Impact Likelihood Grid
in the bottom right of the risk model For example, where we have assessed a risk as high impactbut low likelihood, we may want to transfer (or spread) some of this risk, to an insurer as asuitable response (in this case number 3) The responses are further described:
1 Terminate Here, where the risk is great and either cannot be contained at all or the costs
of such containment are prohibitive
2 Controls One of the principal weapons for tackling risks is better controls Note that this isthe subject of the next chapter
3 Transfer Where the risks are assessed as high impact but low likelihood, we may wish toadopt a strategy of spreading risk, wherever possible
4 Contingencies A useful response to risk that is again high impact, low likelihood is basedaround making contingency arrangements in the event the risk materializes
5 Take more One dimension of the risk management strategy is derived from the upside riskviewpoint Where the impact, likelihood rating shows operations located down at low/low forboth factors, this does not necessarily mean all is well Risk management is about knowing where
to spend precious time and knowing where to spend precious resources Low/low areas are ripefor further investment (for commercial concerns) or ripe for further innovative development (forpublic sector services)
6 Communicate One aspect of risk management that is often missed relates to high impactand either medium or high likelihood, where controls may not address the risk to an acceptable
Trang 13level, that is a strategy to communicate this risk to stakeholders and make them aware that thisimpairs the organization’s ability to be sure of success (at all times).
7 Tolerate The low/low risks that come out of our assessment will pose no threat and assuch can be tolerated
8 Commission research More developed risk management systems will allow some thinkingtime, where one decision may be to go and find out more about the risk, its impact and whether
it will probably materialize —that is to commission further research
9 Tell someone Some high/high risks create a blockage in that they can only really be resolved
by parties outside of those participating in the risk management exercise
10 Check compliance The final weapon in the arsenal of risk responses is often overlooked.This is to focus on areas where controls are crucial to mitigating significant risks, and to ensurethat they are actually working as intended
The 5Ts and 5Cs model provides a wide range of techniques for developing a suitable riskmanagement strategy in the bottom right corner of Figure 3.6
3.5 Risk Registers and Appetites
The basic risk model has to be made more dynamic to incorporate the next risk tool, that is therisk register in Figure 3.7
Identification
Assessment Management
FIGURE 3.7 Risk management (7)
The subject of risk registers has a very interesting past Project managers have used themfor a long time as they assess risks at an early stage in a large project and enter the details in
a formal record which is inspected by the sponsors The insurance industry again is well used
to documenting assumptions about risk and using this to form judgements on where to offer
Trang 14insurance cover and what aspects of an operation are included in this cover More recently, theyhave come to the fore as an important part of general business risk management Risk registersact as a vehicle for capturing all the assessment and decisions made in respect of identified risks.Moreover, the registers may form part of the assurance process where they can be used asevidence of risk containment activity, which supports the statement of internal control We havesuggested that risk management is simply the task of defining risk, identifying risks, assessing thisrisk for impact and materiality and then devising suitable ways of dealing with more significant risks.Risk registers can be attached to this process to record the above stages and end up with both arecord and action plan The register in our model in Figure 3.7 is a basic version that details thekey objectives in question, the risks that have been identified by those closest to the action, theirimpact and likelihood and then a set of actions required to reflect the adopted strategy, which
is then the responsibility of the risk owner The register should be updated to reflect changes inthe objectives, external and internal risks and controls, all of which in turn happens because ofchanges in the environment within which we operate What goes in the register and what wedocument as significant as opposed to immaterial risk depends on the perception of risk, that isthe risk appetite, or what some call the risk tolerance An elementary diagram forms the basis for
a consideration of risk appetite in Figure 3.8
INHERENT RISK
MORE RISK
MORE CONTROLS
ACCEPT RISK
RISK MANAGEMENT STRATEGY AND CONTROLS RESIDUAL RISK
FIGURE 3.8 Risk appetites
The risk appetite defines how we see residual risk, after we have dealt with it through anappropriate strategy, and whether it is acceptable or not, that is, is the risk acceptable as it stands
or do we need to do more to contain it, or perhaps exploit areas where risk is too low? Weneed to turn once again to Peter Bernstein for an authoritative view on risk appetites In short,
it all depends: ‘Few people feel the same about risk every day of their lives As we grow older,wiser, richer, or poorer, our perception of risk and our aversion to taking risk will shift, sometimes
in one direction, sometimes in the other.’7
The concept of risk appetite (or tolerance) is very tricky to get around The contrasting positionsare that the board sets a clear level of tolerance and tells everyone inside the organization; orthat people are empowered to derive their own levels based around set accountabilities Theseaccountabilities mean defined people are responsible for getting things right and also must explainwhere this has not happened and things are going wrong
While authoritative writers have argued that: ‘risk like beauty is in the eye of the beholder.Although many people associate risk with loss of assets, the concept is viewed by the auditor asmuch broader.’8
If an organization gets the risk tolerance wrong then key stakeholders may well misunderstandthe extent to which their investment is insecure, and conversely, where corporate risk tolerance
Trang 15is low, returns on investment may be likewise restrained Funds will move in accordance with thelevel of risk that they are attracted to, so long as this level has been properly communicated toall interested parties Risk appetite varies between organizations, between departments, betweensection, teams and more importantly between individuals.
If risk tolerance throughout an organization hovers at different levels with no rational explanation,then we may well experience problems Key performance indicators need to be set to take onboard acceptable risk tolerances so that the organization is pulled in a clear direction and notsubject to fits and starts as different parts of the organization slow things down while others aretrying to speed them up Where the entire organization has a high risk tolerance, then it will tendnot to install too many controls, particularly where these controls are expensive
One model used to assess risk appetite uses the scale in Figure 3.9
RISK SEEKER
FIGURE 3.9 Risk attitudes and controls
Here we balance the extent to which an organization’s management seeks risk with the degree
to which there are effective controls in place Some people are active risk seekers as is clear fromone article which describes how a gambling addict who ran up a £33,000 credit card bill has beenjailed for a year and ordered to pay back the money ‘In his three month spending spree, he neverwon more than a fiver.’9
When considering risk tolerance, we need to build the control factor into the equation Risktaking is fine so long as we can anticipate problems and work out how to counter them Muchconfusion results from mixing gross and net risk Risk, before we have put in measures to dealwith it, is gross, or what we have called inherent risk Risk that has been contained, so far as ispracticable, is net, or what we have called residual risk A high risk occupation such as an astronautmay in practice be relatively safe because of the abundance of controls in place for each journey.The risk tolerance for space exploration agencies may be near on zero, with a focus on controlsand quality assurance routines and numerous tests of these controls
Attitudes to risk tolerance become even more important when we consider the responsibilities
of an organization to its stakeholders The board members have a fiduciary duty to act in areasonable manner and shareholders have a right to receive any announced dividends and tohave their investment managed adequately But, they will also need to understand the way theorganization behaves towards risks
While companies need to work out their view on risk, it is much the same for governmentbodies The NAO has reviewed risk management in government bodies along with the need
to support innovation They recognize that the civil service culture has: ‘values, ethos, ethicsand training underpinning the department’s management approach—has traditionally been risk