Assessing The Adequacy 2010
Assessing The Adequacy 2010
Assessing the
Adequacy of
Risk Management
Using ISO 31000
December 2010
Table of Contents
Executive Summary...................................................................................... 1
Introduction ................................................................................................. 1
Risk Management in the Organization........................................................ 2
Internal Auditing and Risk Management..................................................... 5
Internal Audit Review of Risk Management................................................ 6
Obtaining Audit Evidence............................................................................. 8
Assurance of the Risk Management Process............................................. 9
Assessing the Quality of
Risk Management Documentation............................................................. 13
Authors ...................................................................................................... 14
Reviewers & Contributors.......................................................................... 14
www.theiia.org/guidance
Executive Summary
Many organizations are moving to adopt consistent and
holistic approaches to risk management and recognize that
risk management is a management process that should be
fully integrated with the management of the organization.
It applies at all levels of the organization enterprise level,
function level, and business-unit level.
The risk management framework must be designed to suit
the organization: its internal and external environment. For
risk management to be effective, the framework in any organization, regardless of size or purpose, should contain
certain essential elements. This guide details three approaches to assurance of the risk management process: a
Process Elements approach; an approach based on Principles of Risk Management; and a Maturity Model approach.
The assurance process that is used should be tailored to the
organizations needs.
Internal auditors should have a means of measuring the
effectiveness of risk management in an organization. This
can be achieved by the examination of criteria that reflect
aspects of the risk management process. The criteria used
must be relevant, reliable, understandable, and complete.
The aggregate of the observations should allow the auditor to form a conclusion on the organizations level of risk
management maturity.
perform the risk assessment. This guidance does not imply implicit or explicit endorsement of this or any other framework.
Introduction
Over the last few years, the importance of managing risk
as part of strong corporate governance has been increasingly acknowledged. Organizations are under pressure to
identify the significant business risks they face social,
ethical, and environmental as well as strategic, financial,
and operational and to explain how they manage them.
The use of enterprise-wide risk management frameworks
has expanded as organizations recognize the advantages of
coordinated approaches to risk management.
Risk management is defined in the Glossary of the International Standards for the Professional Practice of Internal Auditing (Standards) as a process to identify, assess,
manage, and control potential events or situations to provide reasonable assurance regarding the achievement of
the organizations objectives.1 A comprehensive risk management framework provides an end-to-end link between
objectives, strategy, execution of strategy, risks, controls,
and assurance across all levels in the organization.
This practice guide uses ISO 31000 as a basis for the risk
management framework. Other frameworks may be used to
This is consistent with the International Organization for Standardizations (ISOs) definition of risk management, which is coordinated activities to direct and control an organization
with regard to risk. (ISO Guide 73:2009 Definition 2.1)
www.theiia.org/guidance
The internal auditor should assess whether the framework takes into consideration and defines risk management responsibilities and the risk management strategy,
and whether the elements of the framework allow for the
building of a risk-smart workforce and environment while
still allowing for responsible risk-taking and innovation.
ISO.This material is reproduced from either ISO 31000:2009 or ISO Guide 73:2009 with permission of the American National Standards Institute (ANSI) on behalf of the
International Organization for Standardization (ISO). No part of this ISO material may be copied or reproduced in any form, electronic retrieval system or otherwise made available on the
Internet, a public network, by satellite or otherwise without the prior written consent of ANSI.Copies of this standard may be purchased from ANSI, 25 West 43rd Street, New York, NY
10036, (212) 642-4900, http://webstore.ansi.org
Ibid.
www.theiia.org/guidance
Mandate
and
commitment
Design of
framework for
managing risk
Continual
improvement
of the
framework
Implementing
risk
management
Monitoring and
review of the
framework
ISO.This material is reproduced from either ISO 31000:2009 or ISO Guide 73:2009 with permission of the American National Standards Institute (ANSI) on behalf of the International Organization for Standardization (ISO).No part of this ISO material may be copied or reproduced in any form, electronic retrieval system or otherwise made available on the
Internet, a public network, by satellite or otherwise without the prior written consent of ANSI.Copies of this standard may be purchased from ANSI, 25 West 43rd Street, New York, NY
10036, (212) 642-4900, http://webstore.ansi.org
www.theiia.org/guidance
introduction of new processes. Furthermore, entity objectives, as well the nature of potential events or conditions
that may affect the achievement of those objectives, will
change. Accordingly, management needs to determine
whether the ERM components continue to be relevant
and able to address new risks.
A critical element of a sound risk management system is
monitoring to ensure it is performing as intended. Monitoring can be done in two ways: through ongoing activities or separate evaluations. This combination of ongoing monitoring and separate evaluations will ensure that
ERM maintains its effectiveness over time.
ERM processes incorporate periodic evaluation of risks
and risk ratings. The greater the degree and effectiveness
of ongoing monitoring, the less the need there may be for
separate evaluations. The frequency of separate evaluations necessary for management to have reasonable assurance about the effectiveness of ERM is a matter of
managements judgment. In making that determination,
consideration is given to the nature and degree of changes, the competence and experience of the people implementing risk responses and related controls, the nature
and significance to the business of the risks that are being
managed and the results of the ongoing monitoring.
Ongoing monitoring is built into the normal, recurring operating activities of an entity. It can be more effective than
separate evaluations, because it is performed on a realtime basis, reacting dynamically to changing conditions,
and is ingrained in the entity. Problems will often be identified most quickly by ongoing monitoring processes since
separate evaluations take place after the fact. Some entities with sound ongoing monitoring activities will nonetheless conduct a separate evaluation of ERM, or portions
thereof. The perceived level of objectivity is greater for
separate evaluations than for self-monitoring.
An entity that perceives a need for frequent separate
evaluations should focus on ways to enhance its ongoing
www.theiia.org/guidance
Risk management is a management process that promotes the cost-effective achievement of organizational
objectives; assurance provides reliable information about
the achievements of risk management activity. Assurance
and risk management are complementary processes.
In support of the risk management process, internal auditing and other independent assurance providers would
assess whether:
The risk management process has been applied
appropriately and all elements of the process are
suitable and sufficient.
The risk management process is in keeping with the
strategic needs and intent of the organization.
All significant risks have been identified and are being treated.
Controls are being correctly designed in keeping
with the objectives of the risk management process.
Critical controls are adequate and effective.
Review by line management and other nonaudit
assurance activities are effective at maintaining and
improving controls.
Risk treatment plans are being executed.
www.theiia.org/guidance
For higher risk areas where management has acknowledged the need to improve controls, there may be an opportunity for internal auditing to add value to the organization through consulting activities. The middle third of
audit activities in Figure 2 above represent advisory and
consulting activities, delivered at the entity or business
unit/departmental level, in a manner that should maintain
internal auditings independence and objectivity.
roce
are co
r
r is
ks
rectly
ova
l
se
isk
ro c
es
the
r
ma
na
ge
m
en
tp
ttin
g
Se
ERM
stra
te gy
for
b
ap
p
eti
oard
te
app
r
e nt o f
tablis
hm
i ng e s
po
sin
gr
isk
i ng
Cham
pi o n
developing the ER
M framework
ERM
m
age
T ak
sse s
evalua
ted
me
I m pl e
n
Ma
Im
ey
D ev
e lo p
fk
nt p
fk
M aintaining and
to
age
me
go
r ting on r isks
en
r tin
me
age
d
an
em
ag
an
e po
Giving
assur
ance t
hat r is
ks
Giving assurance
o
on
ati
fic
m
the
man
man
nti
i ng
r isk
hing
i de
ie w
E va
luat
i ng
the
r
o
Consolidated rep
ties
activi
isk s
g ERM
to r
s
inatin
i ng
isk
Coord
o nd
fr
r e sp
no
tio
nt i n
l ua
e va
ks
r is
ey
c
Coa
ng
ati
ilit
Fac
v
Re
E va
l ua
tin
g
nting
i ng
r isk r e
sp
e nt
ass
o
nce
ur a
isio
de c
ns
nr
isk
on r
on m
o ns e s
r e sp
m
anage
A ccountability for
isk
o ns
es
ents b
ehalf
r isk management
www.theiia.org/guidance
Are external communication and reporting mechanisms adequate to comply with relevant legal,
regulatory, corporate governance, and disclosure
requirements?
The cumulative effect over time of such assurance activities over specific risk areas in a risk-based audit plan will
provide assurance not only over those specific risk areas,
but serve as assurance of the effectiveness of the overall
risk management process.
www.theiia.org/guidance
www.theiia.org/guidance
Surveys.
Analysis of control self-assessment.
Often, a combination of different audit techniques will
be used to gather sufficient information and evidence
to reach a conclusion. The auditor selects the most
appropriate procedure for the audit objective of the
assignment. The auditor also assesses whether sufficient
resources and skills are available to perform all the work
required to provide sufficient support for an opinion. The
auditor considers whether it might be prudent to decline
to express the opinion or to qualify the opinion by excluding certain areas or risks from the scope of the opinion if
sufficient resources or skills are not available.
The requirement for evidence will vary depending on
the kind of opinion the auditor wishes to render. Positive assurance provides the highest level of assurance
and normally also requires the most evidence to support the opinion. Such an opinion implies not only, for
example, whether controls/risk mitigation processes are
adequate and effective, but also that sufficient evidence
was gathered to be reasonably certain that evidence to the
contrary, if it exists, would have been identified.
Negative assurance does not provide as much assurance and therefore normally does not require as much
audit evidence. When rendering negative assurance, the
auditor, for example, states that based on the work done,
nothing came to the auditors attention. By rendering
such an opinion, the auditor takes no responsibility for
the sufficiency of the audit scope and procedures to find
all significant concerns or issues. Such an opinion is generally considered less valuable than positive assurance.
More extensive guidance on opinions can be found in
the Practice Guide Formulating and Expressing Internal
Audit Opinions.
These approaches are quoted from HB158:2010 Delivering assurance based on ISO 31000:2009 Risk management Principles and guidelines, A joint publication of Standards
Australia, IIA-Australia, and the IIA Research Foundation. HB158 provides a more extensive discussion of these and other issues.
www.theiia.org/guidance
ISO. This material is reproduced from either ISO 31000:2009 or ISO Guide 73:2009 with permission of the American National Standards Institute (ANSI) on behalf of the
International Organization for Standardization (ISO). No part of this ISO material may be copied or reproduced in any form, electronic retrieval system or otherwise made available on the
Internet, a public network, by satellite or otherwise without the prior written consent of ANSI.Copies of this standard may be purchased from ANSI, 25 West 43rd Street, New York, NY
10036, (212) 642-4900, http://webstore.ansi.org.
Ibid.
www.theiia.org/guidance
10
includes a section (Clause 4) on these principles. An audit based on these principles would assess to what extent
they are true for the risk management process in an organization:
Risk management creates and protects value.6
This implies the application of the most rigorous risk
management when the value at stake is highest. It
also suggests that a range of techniques applicable at
various levels of exposure should be available in the
organization.
Risk management is an integral part of organizational processes.7 Risk management should not
be seen as an add-on task.
Risk management is part of decision-making.8
The more important the decision, the more explicit
this association should be.
Risk management explicitly addresses uncertainty.9 Risk assessments would be expected to
document areas of uncertainty and consider how
best to address the uncertainty identified.
Risk management is systematic, structured,
and timely.10
Risk management is based on the best available information.11 Obtaining information can be
expensive and the process should provide guidance
on what constitutes sufficient information.
Risk management is tailored.12 It is not an outof-the-box process and must match the operations of
the organization.
Risk management takes human and cultural
factors into account.13 The processes must be
ISO. This material is reproduced from either ISO 31000:2009 or ISO Guide 73:2009 with permission of the American National Standards Institute (ANSI) on behalf of the International Organization for Standardization (ISO). No part of this ISO material may be copied or reproduced in any form, electronic retrieval system or otherwise made available on the
Internet, a public network, by satellite or otherwise without the prior written consent of ANSI. Copies of this standard may be purchased from ANSI, 25 West 43rd Street, New York, NY
10036, (212) 642-4900, http://webstore.ansi.org.
9
Ibid.
10
Ibid.
11
Ibid.
12
Ibid.
13
Ibid.
14
Ibid.
15
Ibid.
16
Ibid.
www.theiia.org/guidance
/ 11
8
Measure
Meaning
None
Very little or no
compliance with the
requirement in any
way.
Very Little
Only limited
compliance with the
requirement.
Management
supports the intent,
but compliance in
practice is poor.
Some
Good
Limited compliance
with element statement. Certainly agree
with the intent, but
limited compliance in
practice.
Management
completely
subscribes to the
intent, but there is
partially complete
compliance in
practice.
Complete
Absolute compliance
with the element
statement in intent
and in practice at
all times and in all
places.
www.theiia.org/guidance
12
Many aspects of ERM may be informal and undocumented and yet can be regularly performed and highly effective. These activities may be tested in the same ways as
documented activities. The fact that elements of ERM are
not documented does not necessarily mean that it is not
effective or cannot be evaluated. An appropriate level of
documentation, however, usually makes monitoring more
efficient. It is helpful in other respects too. It facilitates
employees understanding of how the process works and
their particular roles, and makes it easier to make modifications when necessary.
www.theiia.org/guidance
13
Authors
Andrew MacLeod, CIA
Patricia A. MacDonald
Benito Ybarra, CIA
Trygve Sorlie, CIA, CCSA
Brian Foster, CIA
Teis Stokka, CIA
www.theiia.org/guidance
14
Disclaimer
The IIA publishes this document for informational and educational purposes. This guidance material is not intended to provide definitive answers
to specific individual circumstances and as such
is only intended to be used as a guide. The IIA
recommends that you always seek independent
expert advice relating directly to any specific situation. The IIA accepts no responsibility for anyone placing sole reliance on this guidance.
Copyright
The copyright of this position paper is held by The
IIA. For permission to reproduce, please contact
The IIA at [email protected].
global headquarters
T:
+1-407-937-1111
F:
+1-407-937-1101
W:
www.theiia.org