AC948 Case Studies in Financial Environments Lecture 10: Risks and corporate governance

1
AC948 Case Studies in Financial Environments
Lecture 10 Risks and corporate governance

• Yuval Millo, AFM, U. of Essex

2
Reactions to Enron Enterprise Risk Management

• Today we will discuss a set of tools that is
  aimed at controlling the types of problems we saw
  in the TLCM and the Enron cases
• Incorrect assessment of the risks inherent in
  business strategies
• Insufficient control and monitoring over the
  steps taken

3
ERM

• The framework was developed by COSO a voluntary
  organisation sponsored by
• American Institute of Certified Public
  Accountants
• American Accounting Association
• Financial Executives International
• The Institute of Internal Auditors
• Institute of Management Accountants
• The framework is voluntary, is very influential

4
Strategic definitions

• Setting objectives what risks are inevitable?
• Risk appetite how much risk is the management
  willing to accept?
• The assumption there is a correlation between
  link and value
• Risk tolerance what is the variance around the
  risk objectives that is acceptable?

5
Determining risk appetite

• Assessing is both quantitative and qualitative
  risk-adjusted return, reputation risk, political
  risk
• Risk includes interactive and reflexive elements
• Interaction between various areas may increase
  risk
• Risk management may, in itself, increase risk

6
Responses to Risk

• Accept the risk and monitor it
• Avoid the risk and eliminate the corporations
  involvement
• Reduce the risk through improving internal
  operational procedures
• Share the risk with others outside the
  corporation

7
Risk assessment

• Risks are assessed according to the extent they
  will affect the objective of the organisation.
• This extent follows a two-dimensional scheme
• The likelihood that the risk would materialise
• The impact on the objectives if the risk
  materialises

8
Impact and likelihood
High
High Risk
Medium Risk
I m p a c t
Share
Avoid
Medium Risk
Low Risk
Reduce
Accept
Low
High
Probability
9
The role of internal auditors

• Evaluating the efficacy of the risk management
  steps
• Monitoring that proposed steps are carried out
• Reporting interface between the corporation and
  external regulators
• Recommending improvements

10
What the internal auditors should not do

• According to the IAA auditors should not
• Set the risk appetite
• Impose risk management steps
• Take part in the decisions about risk management
  steps
• What does this view tell us about the role of the
  auditor?
• How can this role help to prevent more Enrons?