Managing R

• “The biggest risk a

person can take is to
do nothing.”
 Internal auditing is an independent,
objective assurance and consulting
activity designed to add value and
improve an organization’s operations. It
helps an organization accomplish its
objectives by bringing a systematic,
disciplined approach to evaluate and
improve the effectiveness of risk
management, control and
governance processes.
1
Ag
What is Risk?

en
2 The Risk Challenge

3 Risk Management &

Residual Risk
4 Mitigation through
Controls
5 Risk Registers &
Appetites
 The word ‘risk’ derives from the
What is
early Italian ‘Risicare’,
Risk? which means to dare’.

IIA Glossary defines risk as ‘the

uncertainty of an
event occurring that
could have an
impact on the
achievement of
Risk also:
THE POSSIBILITY THAT AN ORGANIZATION
WILL NOT:

achieve its goals

operate effectively and efficiently
protect itself from loss (fraud)
provide reliable financial data
comply with laws and defined policies
 The Risk
Risks arise in Risks
totally unexpected
ways and can have
a major effect on
the key aspects of
our lives.
Impac
t
 The Risk
Challenges
Risks

Oppor
Threat Object
tunitie
s ives s

Upside and downside

Impac
t
part of risk
THREATS
•
 The Risk
Challenges
Risks

Oppor
Threa Objec
tuniti
ts tives es
High

Likeli
hood
Impac Med

Materialize Risk t
High Med Low
Low

• whether it is worth securing more

information or examining the
reliability of the existing information.
Risk
Management
• is a dynamic process for taking
all reasonable steps to find out
and deal with risks that impact
on our objectives. It is the
response to risk and decisions
made in respect of available
Residual Risk
choices
• is the amount of risk that
remains after controls are
accounted for.
 Reviewing
• consider whatReports
are the significant
risks and assess how they have
been identified, evaluated and
managed;
• assess the effectiveness of the
related system of internal control in
managing the significant risks;
• consider whether necessary actions
are being taken promptly;
• consider whether the findings
indicate a need for more extensive
 Stages of Risks
Risk REVIEW IDENTIFICATION
Oppor
Management Threa Objec
tuniti
ts tives es
MANAGEMENT ASSESSMENT High

Likeli
hood
Impac Med

t Low

High Med Low

 T C
 TERMINATE  CONTROLS
 TRANSFER  CONTINGENCY

TAKING CARE OF RISK

 TAKE MORE  COMMUNICATE
 TOLERATE  COMMISSION
 TELL SOMEONE RESEARCH
 CHECK
COMPLIANCE
Mitigation
through
 Segregation of duties is a

Controls
preventive control that aids in the
timely detection of errors and
irregularities in the normal course
of business.
 Risk
Registers
- Used as risk management tool and to
fulfill regulatory compliance acting as a
repository for all risks identified and
includes additional information about
each risk, e.g. nature of the risk,
reference and owner, mitigation

Risk
measures.

Appetite
- Defined as ‘the amount and type of
risk that an organisation is willing to
take in order to meet their strategic
objectives.
 Elements of Risk
Risk Identifier
Registers
Ownership

Risk Description
Mitigation

Risk Trigger Residual Risk

Probability Accepted
Probability
Impact
Accepted Impact
Score