风险管理和内部控制指引.pptVIP

Consider both Likelihood and Impact Likelihood: possibility an event will occur, measured in “low, medium, high,’ percentage or some frequency of occurrence. Impact: Effect on an agency on others. Risk Assessment Uses Qualitative and Quantitative Methods Quantitative methods more precise Qualitative methods are necessary in situations where business activity does not lend to quant. evaluation, or is not cost/effective. Choice should reflect needs of the business unit and its employees. Consider Risk in Objective Setting The framework of objectives: strategic, operational, reporting, compliance, (see COSO cube). Typically considerable overlap. Several examples follow. Example: Operational Risk that subrecipients in HIV/AIDS program are being reimbursed for unsupported expenditures. Assessment – Extent of reimbursement and frequency is analyzed. Note that paying subrecipient invoices for which no documentation exists subjects agency to possible fraud. Example: Reporting Risk that management does not notify the Comptroller’s Office of overpayments; and failure to recover funds. Assess why a breakdown in both state policy and actual recoupment. Lack of notification negates possibility of a thorough investigation. SECTION V RISK RESPONSE V – Risk Response “Having assessed relevant risks, management determines how it will respond, reviewing likelihood and impact, evaluating costs and benefits, and selecting options that bring residual (remaining risk) within the entity’s risk tolerances.” The Four Categories of Risk Response: Avoidance – not participating in events that give rise to risk. Reduction: Specific actions taken to reduce likelihood or impact or both. Sharing: Reducing likelihood or impact by sharing portion of the risk (insurance) Acceptance: No action taken. “learns to live with the risk,” and monitor it... Additional Factors in Risk Response - For many risks, responses are obvious well accepted. - Response to risk may affect other factors, or affec