Risk Assessment and Risk Response

The fourth and fifth components of COSO’s ERM mode are risk assessment and risk response.

The risks that exist before management takes any steps to control the likelihood or impact of a risk are called inherent risks.

The risk that remains after management implements internal controls, or some other response to risk, is residual risk.

The ERM model indicates that there are four ways to respond to risk:

Reduce. The most effective way to reduce the likelihood and impact of risk is to implement an effective system of internal controls.

Accept. Accepts the likelihood and impact of the risk by not acting to prevent or mitigate it.

Share. Share some of the risk or transfer it to someone else. For example, buy insurance, outsource an activity, or enter into hedging transactions.

Auditing definition of hedges: hedges protect an entity against the risk of adverse price or interest-rate movements on its assets, liabilities, or anticipated transactions. A hedge avoids or reduces risk by counterbalancing losses with gains on separate positions.

Hedge, in securities, is a transaction that reduces the risk of an investment.

Hedge fund is a special type of investment fund with fewer restrictions on the types of investments it can make. Of note is a hedge fund’s ability to sell short. In exchange for the ability to use more aggressive strategies, hedge funds are more exclusive (e.g., fewer people), usually only the wealthy are allowed to invest in hedge funds.

There are three main types of hedges: fair value hedges, cash flow hedges, and foreign currency hedges—which are beyond the scope of this class.

Avoid. Risk is avoided by not engaging in the activity that produces the risk. This may require the company to sell a division, exit a product line, or not expand as anticipated.

Accountants can assess and reduce inherent risk using the risk assessment and response strategy shown in Figure 7-4.

Estimate Likelihood and Impact

Some events pose a greater risk because the probability of their occurrence is more likely

For example, a company is more likely to be the victim of a fraud than of an earthquake, and employees are more likely to make unintentional errors than they are to commit fraud.

Identify Controls

Management must identify one or more controls that will protect the company from each event.

Estimate Costs and Benefits

No internal control system can provide foolproof protection against all events, as the cost would be prohibitive.

In addition, because many controls negatively affect operational efficiency, too many controls slow the system and make it inefficient.

The benefits of an internal control procedure must exceed its costs.

Benefits can be hard to quantify, but include:

Increased sales and productivity.

Reduced losses.

Better integration with customers and suppliers.

Increased customer loyalty.

Competitive advantages.

Lower insurance premiums.

Costs are usually easier to measure than benefits.

Primary cost is personnel, including:

Time to perform control procedures.
Costs of hiring additional employees to effectively segregate duties.
Costs of programming controls into a system.

Other costs of a poor control system include:

Lost sales.
Lower productivity.
Drop in stock price if security problems arise.
Shareholder or regulator lawsuits.
Fines and penalties imposed by governmental agencies.

One way to estimate the value of internal controls involves expected loss, the mathematical product of impact and likelihood:

Expected loss = Impact × Likelihood

Determine Cost/Benefit Effectiveness

Total pay period payroll cost $10,000.

Extra cost of $600 per pay period will reduce the likelihood of the event from 15% to 1%.

The expected risk cost without the extra $600 validation procedure is $1,500 [$10,000 × 15%].

The expected risk cost with the extra $600 validation procedure is $100 [$10,000 × 1%].

The expected benefit of the validation procedure is $800 as shown in Table 7-2.

Implement Control or Avoid, Share, or Accept the Risk

When controls are cost-effective, they should be implemented so that risk can be reduced.

Risks that are not reduced must be accepted, shared, or avoided.