Monitoring and controlling risk and enterprise risk management

A company has a risk policy, a risk map and a risk committee. Then a branch manager hides a fraud for six months because he fears being blamed. The policy was sound. The culture was not. Monitoring risk means checking that the system works in practice.

Controlling risk means choosing what to do about each risk once it is known: spread it, pass it on, share it, hedge it, avoid it, reduce it or accept it.

This topic covers the roles of the risk manager, the risk committee and the risk audit, how to embed risk awareness in culture and systems, the methods of controlling risk (diversification, transfer, sharing, hedging, avoidance and retention), the TARA framework, enterprise risk management (ERM) and ISO 31000. The previous topic covered how risks are identified, assessed and measured. The next area covers corporate governance.

Neither the May 2014 nor the November 2014 Pathfinder sets a stand-alone question on this topic.

Key terms in plain English

Syllabus check

This topic is in syllabus area C (risk management, 5% of the marks). It covers:

• monitoring risk through risk managers, committees and audits, and embedding risk awareness;
• methods of controlling risk, including diversification, hedging and the TARA framework;
• enterprise risk management and ISO 31000.

CAMA 2020 and risk control

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria.

Monitoring risk

There is no widely accepted structure for risk management. Each entity builds its own.

The risk manager

Companies may appoint risk managers for all risk or for one area: insurance, health and safety, information technology, human resources, treasury or compliance. A risk manager is not a line manager and is not directly responsible for managing the risk. The role is to give information, help and advice, and to raise risk awareness.

Tasks include helping to identify risks, setting up tools and models to identify, assess and measure them, collecting incident reports, helping line managers review internal audit reports, preparing risk reports for senior management or committees, and promoting best practice. Effectiveness depends on the role (a health and safety manager may be able to insist on compliance, and an insurance manager may buy cover) and on the support of the board.

Risk committees

A risk committee may be a committee of the board, which meets the board’s duty to review risk management, or an inter-departmental committee that covers strategic, operational, financial, compliance or environmental risk. Committees do not have management authority to decide on control. They identify and monitor risks and report on effectiveness.

Internal auditors and risk managers may sit on them or report to them, and the board should receive regular reports.

Risk auditing

Monitoring checks that processes to identify risk are effective, that controls exist, that the systems work, that the level of risk matches board policy, that failures are investigated and that weaknesses are corrected. A risk audit is an independent investigation of an area of risk management.

Unlike an external audit of accounts, it is not mandatory, although regulators require regulated businesses such as financial services firms to carry out audits or stress tests. External auditors review financial controls in the annual audit. Risk audits can extend to operational, compliance and environmental risk and can be done by internal or external people.

Internal or external? Internal auditors and risk managers know the company, its systems and culture, so they can do detailed, context-specific audits and write reports that management understands. The drawback is the familiarity threat: they may miss weaknesses. External auditors or consultants are more independent and may know current methods, but a consultancy may push a ready-made solution that does not fit.

Four stages of a risk audit:

1. Identification: find the current risks, which change continually.
2. Assessment: judge probability and impact. Expected loss = probability × impact.
3. Review: examine the controls in place, such as insurance or internal controls, for each material risk.
4. Report: to the board or whoever commissioned the audit.

Embedding risk

Risk managers, committees and audits help, but every manager and employee must be aware of risk. Managers take decisions that create risk and must be satisfied that it is justified. Senior managers answer for strategic risk, and every employee must contain operational risk, for example by following health and safety rules, reporting incidents and control failures, and, in a bank, understanding anti-money laundering and mis-selling rules.

In the culture

Culture is set by the board and senior management (the “tone at the top”). Risk awareness is embedded when thinking about risk is a normal part of behaviour. Reporting systems should exist and information should be shared. Bad news should be reported at once, because earlier detection means less loss. That needs openness and no blame culture: people should not be criticised for a mistake if they own up promptly. Mistakes should be analysed to prevent repeats.

In systems and procedures

Risk management should be part of everyday management and not an add-on. ICAN’s example is a two-stage planning process. Stage 1: managers preparing plans identify the key risks to their targets and the controls needed. Stage 2: before approval, they run sensitivity or scenario analysis to measure the effect of adverse events, for example weak sales demand or a failed product launch, and report the results.

Limits of the risk team

A risk team can help build the framework and train staff, but it cannot create the culture, which the board must set, and it cannot be the only risk manager. The business managers who created the risk must own it. The team makes sure the right people manage the right risks.

Methods of controlling risk

Internal controls handle financial, operational and compliance risk. Beyond them are the following methods.

Diversification

Spreading risk across a portfolio of activities so that good results offset bad ones. An investor who holds shares in many industries and countries limits the loss on any one to the amount invested in it. For a company it suits businesses whose managers have the skills to run the portfolio, such as a film studio moving across cinema, television and home entertainment.

It is risky and less suitable when the businesses are unrelated, because management lacks the skills and investors can diversify themselves. It reduces little risk where the activities are exposed to the same conditions, as with house-building, window and brick making that all depend on the housing market.

Risk transfer

Passing the risk to someone else, most commonly by insurance. It suits risks with a high potential loss and a fairly low probability.

Risk sharing

Collaborating to share risk, through partnerships and joint ventures. Partners share investment, management, cost, risk and reward. A global company may enter a country with a local partner that knows the market, and a local company reduces its financial risk by joining a foreign one.

Hedging

Taking a position that offsets an exposure. A company that loses if the dollar falls against the euro takes a hedge that gains if it falls. Derivatives such as futures, options and swaps are used. Later topics cover these in detail.

Risk avoidance and retention

Controls reduce risk but do not remove it. What is left is residual risk. The basic choice is between avoidance (no exposure, by not investing or by leaving a market) and retention (accepting the risk for the expected return, and managing it within limits). The choice depends on risk appetite, which the board sets.

It can be shown as risks the board will not accept (for example, a water company that will not invest abroad), as limits on new investment in each area, or on a dashboard.

Appetite varies. Small entrepreneurial firms may take more risk because owners are also directors, and the loss is limited by their size. Large well-diversified firms can accept a big individual risk, for example a bank with one large borrower. Large bureaucracies may be averse to risk. New and volatile markets carry high risk and need a high appetite, and mature markets are more stable and so appetite is lower.

The TARA framework

• Transfer the risk, usually by insurance.
• Avoid it by not doing the activity or withdrawing, which makes sense when the risk is too high for the return.
• Reduce it, for example with internal controls against error and fraud.
• Accept it, when the risk is small and the cost of reducing or transferring it is not worthwhile.

Enterprise risk management and ISO 31000

Enterprise risk management

The board should make sure there is a robust risk framework. Many companies use an enterprise-wide framework so that risk is handled the same way throughout the group. A risk is any event or action that might stop the company meeting its strategic objectives and so adding to stakeholder value.

The framework works at three levels: set the approach and vision; commit resources and build the infrastructure, capabilities and skills; and implement systems for assessment, control and monitoring.

• Approach: senior management sets a clear risk strategy, a risk culture, consistent definitions and a common framework.
• Infrastructure: a risk structure, up-to-date policies and procedures, and specialist assurance functions (internal audit, health and safety, IT assurance, insurance, environmental).
• Capabilities: training, personal objectives that refer to risk and control, and early-warning systems.
• Assessment: identification and measurement, risk mapping, scenario analysis for complex sectors, and a named owner for each critical risk.
• Treatment: controls to mitigate the risk, tested for design and operation, with regular review of controls for critical risks. Residual risk is understood and monitored.
• Monitoring: by the managers who own the risks and, at a senior level, by key performance indicators and key risk indicators. The board gets regular reports on the risk profile, control testing, results and action plans.

ISO 31000

The International Organization for Standardization issued ISO 31000 on risk management systems in 2009. It can be used by any organisation and for any type of risk, to promote international standardisation. Guidance on it was issued in 2010 by the Institute of Risk Management with Airmic and Alarm. The standard was revised in 2018. It has three elements:

1. Risk architecture: the roles and responsibilities of the board, audit committee, risk committee, chief executive, business unit managers, employees, risk managers, specialist functions and internal auditors, and the reporting structure.
2. Risk strategy: the stated strategy and the board’s risk appetite, with an action plan and resources.
3. Risk protocols: the rules, procedures and methods for assessment, response and incident reporting, a business continuity plan and audit of the efficiency and effectiveness of controls.

ICAN also gives the “7Rs and 4Ts”. The steps are recognition of risks, ranking, responding, risk treatment, resourcing controls, reaction planning, reporting and monitoring, and reviewing the framework. The treatment options are the 4Ts: tolerate (accept), treat (control or eliminate), transfer and terminate (end the activity).

The rules in more depth

Why a risk committee has no management authority

The line manager owns the risk and the decision. The committee gives the board independent information, and keeping the roles separate avoids confusion over who is accountable.

Why a blame culture hides risk

People who expect punishment hide errors, so the board learns of problems late and the loss is bigger.

Why diversification works only for different risks

If all the businesses react to the same event, they fall together and little risk is removed.

Why insurance suits rare, large losses

Premiums are affordable when the chance of a claim is low. For frequent small losses, it is cheaper to control or accept them.

Effect on analysis

When you advise, state the risk, choose from transfer, avoid, reduce or accept, test the cost against the benefit and say who will monitor it.

Worked examples

1. (a) Transfer: insure.
2. (b) Accept: the cost of tighter control exceeds the loss.
3. (c) Avoid: do not enter.
4. (d) Reduce: segregation of duties, cash counts and supervision.

1. Expected loss before.
   4% × 250 = ₦10m.
2. Expected loss after.
   1% × 250 = ₦2.5m.
3. Benefit = 10 − 2.5 = ₦7.5m, which is above the ₦5m cost, so the control is justified.

1. The builder adds little diversification because all three depend on the housing market.
2. The film company has related skills and different demand patterns, so it reduces risk more.

1. The fall is 800 − 640 = ₦160m, or 20%.
2. The manager must show how costs would be controlled and what the profit would be at ₦640m.
3. This makes risk part of the plan, not an add-on.

How to score full marks

• Name the method (TARA or the 4Ts) and apply it to the risk.
• Compare cost and benefit with expected loss.
• Say who monitors: owner, risk manager, committee, audit, board.
• Cover culture and systems when you talk about embedding.
• Match the control to the risk: insurance for rare large losses, internal control for errors.
• Finish with a recommendation.

Common mistakes in the exam

• Giving the risk committee decision-making powers.
• Saying the risk manager owns the risk.
• Recommending diversification into related risks.
• Forgetting the cost test.
• Ignoring culture and blame.
• Mixing up TARA and the 4Ts, or leaving out residual risk.

Quick revision

• Risk manager advises. Committee monitors. Audit: identify, assess, review, report.
• Embed in culture (no blame, bad news early) and in planning (scenarios).
• Methods: diversify, transfer, share, hedge, avoid, retain.
• TARA: transfer, avoid, reduce, accept.
• ISO 31000: architecture, strategy, protocols; 4Ts: tolerate, treat, transfer, terminate.
• CAMA 2020: ss. 308, 385, 404(7), 377(1), 378.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.