{"id":1212,"date":"2019-03-27T09:00:20","date_gmt":"2019-03-27T06:00:20","guid":{"rendered":"https:\/\/teolupus.com\/?p=1212"},"modified":"2024-03-16T11:44:29","modified_gmt":"2024-03-16T08:44:29","slug":"risk-analysis-achievement","status":"publish","type":"post","link":"https:\/\/teolupus.com\/en\/risk-analysis-achievement\/","title":{"rendered":"Risk Management Principle 7: Identification and Analysis"},"content":{"rendered":"[vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_column_text]\r\n

The organization identifies risks to achieving organization-wide objectives and analyzes them to determine how they should be managed.<\/span><\/p>\r\n

Focus Points:<\/b><\/h2>\r\n

The following focal points highlight essential aspects of activities, reporting, and compliance objectives.<\/span><\/p>\r\n

Covers Organization, Subsidiary, Department, Activity Units and Functional Levels.<\/b><\/h3>\r\n

Organization: Identifies and evaluates risks that hinder the organization’s objectives at the enterprise, subsidiary, division, operating unit, and function levels.<\/span><\/p>\r\n

Identification and analysis of risk is a continuous, iterative process conducted to improve the organization’s ability to achieve its objectives. Whether an objective is explicitly stated or implied, the organization’s risk assessment process needs to consider all risks that may arise. This process is supported by various actions, techniques, and mechanisms, all related to overall risk assessment. Management develops and implements controls regarding the performance of such activities.<\/span><\/p>\r\n

Management considers risks at all levels of the organization and takes the necessary measures to respond to these risks.<\/span><\/p>\r\n

Risk identification should be comprehensive. It should consider all significant interactions\u2014goods, services, and information\u2014both within an organization and between business partners and external service providers related to the organization.<\/span><\/p>\r\n

Risk identification considers risks at various levels of the organizational structure, such as the entire organization and its subunits and sales, human resources, marketing, production, and purchasing processes. Enterprise-wide risk identification<\/a> often occurs at relatively high levels and does not generally include assessment of transaction-level risks. Conversely, identifying process-level risks is more detailed and has transaction-level risks. Additionally, the risk assessment considers risks from external service providers, key suppliers, and distribution channel partners.<\/span><\/p>\r\n

Analyzes Internal and External Factors<\/b><\/h3>\r\n

In identifying risks, both internal and external factors and the impact of these factors on achieving objectives are taken into account.<\/span><\/p>\r\n

Management takes into account risks related to internal and external factors. Risk is dynamic. Therefore, management typically considers the rate of change in risks, achievement of objectives, other activity priorities, and costs to determine the frequency of the risk assessment process. Risks at the organizational level can arise from internal and external factors.<\/span><\/p>\r\n

External factors may include<\/b><\/h3>\r\n
    \r\n
  • Economic Factors:<\/b> Those Factors that can affect financing, capital availability, and competitive market entry. For example, such as exchange rate risk and credit risk.<\/span><\/li>\r\n
  • Natural Environment:<\/b> Natural or human-caused disasters or ongoing climate changes that may lead to changes in operations, reduced availability of raw materials, or loss of information systems and require contingency plans.<\/span><\/li>\r\n
  • Regulatory Authority: <\/b>A new financial reporting standard that may require an entity, management operating model, or line of business to provide different or additional reporting; A new antitrust law or regulation that requires the company to make changes to its operating or reporting policies and strategies<\/span><\/li>\r\n
  • Activities in Foreign Countries:<\/b> A change in the government of a foreign country in which the organization operates could lead to new laws and regulations or a change in tax regime (For example, a restriction on travel to a foreign country).<\/span><\/li>\r\n
  • Social Factors:<\/b> Changing customer needs or expectations may affect product development, manufacturing processes, customer service, pricing, or warranties. (For example, Decrease in white bread consumption due to health reasons)<\/span><\/li>\r\n
  • Technological Factors:<\/b> Changes that may affect the availability and use of data, infrastructure costs, and technology-based services. (Decrease in services provided in branches via mobile phone banking)<\/span><\/li>\r\n<\/ul>\r\n

    Internal factors include<\/b><\/h3>\r\n
      \r\n
    • Infrastructure:<\/b> Decisions on using capital resources that may affect operations and the continuity of existing infrastructure.<\/span><\/li>\r\n
    • Management Structure:<\/b> A change in management responsibilities that may affect how specific controls are performed.<\/span><\/li>\r\n
    • Personnel: <\/b>The quality of staff recruited and training and motivation methods that may affect control awareness throughout the organization; termination of contracts that may affect staff status.<\/span><\/li>\r\n
    • Access to Assets: <\/b>The nature of the organization’s operations and employee access to assets that may contribute to the misuse of resources.<\/span><\/li>\r\n
    • Technology:<\/b> An interruption in the functioning of information systems that can negatively impact the organization’s operations.<\/span><\/li>\r\n<\/ul>\r\n

      Identifying internal and external factors that increase organization-level risks is critical to a comprehensive risk assessment. Once the most important factors have been assessed, management will be able to assess the relevance and importance of these factors and, where possible, link these factors to specific risks and actions.<\/span><\/p>\r\n

      Involves Appropriate Levels of Management<\/b><\/h3>\r\n

      The organization puts adequate risk assessment mechanisms that involve appropriate levels of management.<\/span><\/p>\r\n

      As with other processes within the scope of internal control, responsibility and accountability for risk identification and analysis processes rest with management throughout the organization and its subunits. The organization employs effective risk assessment mechanisms, including appropriately qualified and specialized management levels.<\/span><\/p>\r\n

      Estimates the Significance of Identified Risks<\/b><\/h3>\r\n

      Identified risks are analyzed through a process that involves estimating the potential significance of the risk.<\/span><\/p>\r\n

      As part of risk analysis, the organization evaluates the significance of risks to achieving objectives and sub-objectives. Organizations can evaluate the significance of risk using metrics such as these.<\/span><\/p>\r\n

        \r\n
      • The probability of the risk occurring and its impact<\/span><\/li>\r\n
      • Quickness or speed of impact in case the risk occurs<\/span><\/li>\r\n
      • The continuity or duration of the effect after the risk occurs<\/span><\/li>\r\n<\/ul>\r\n

        \u201cLikelihood\u201d and \u201cimpact\u201d are commonly used terms. However, some organizations use terms such as “probability,” “severity,” “seriousness,” or “consequence” instead. While “likelihood” expresses the possibility of an event occurring,” “impact” refers to the impact that this event will have. In some cases, these words acquire more specific meanings. “Likelihood” means that the probability of a particular risk occurring is expressed in degrees such as “high,” “medium,” and “low,” indicating the nature of the risk. \u201cprobability\u201d refers to quantitative measurements such as percentage, frequency of occurrence or other numerical measures.<\/span><\/p>\r\n

        Determines How to Respond to Risks<\/b><\/h3>\r\n

        Risk assessment involves considering how risks will be managed and whether to accept the risk, avoid the risk, reduce the risk, or share the risk.<\/span><\/p>\r\n

        Inherent Risk:\u00a0<\/b>Management considers both natural and residual risks. The intrinsic risk will prevent the organization from achieving its objectives if there are no measures management can implement to change the likelihood or impact of the risk.<\/span><\/p>\r\n

        Residual Risk:<\/b> Residual risk is the risk that prevents the organization from achieving its goals and remains after management’s development and implementation of responses to them. Risk analysis is first applied to inherent risk. As discussed below, management evaluates risks once risk responses have been developed. Assessing inherent risk in addition to residual risk can assist the organization in understanding the scope of responses to risk.<\/span><\/p>\r\n

        Response to Risk:<\/b> Once the potential significance of risks is assessed, management considers how the risk should be managed. This process involves making decisions based on assumptions about the risks and a reasonable analysis of the costs associated with reducing the level of risk. The response does not always result in the least amount of residual risk. However, if the answer to a risk creates a residual risk that exceeds levels acceptable to management and the board, management will re-examine and adjust the response. Therefore, balancing risk and risk tolerance can be an iterative process, as the response does not always result in the least residual risk.<\/span><\/p>\r\n

        Responses to risk fall into the following categories:<\/span><\/p>\r\n

          \r\n
        • Acceptance:<\/b> No action is taken to influence the likelihood or impact of the risk.<\/span><\/li>\r\n
        • Avoidance:<\/b> Stopping actions that lead to risk. This may include discontinuing a product line, refusing to expand into a new geographic market, or selling a division.<\/span><\/li>\r\n
        • Mitigation:<\/b> Measures taken to reduce the likelihood or impact of a risk, or both, often encompass numerous day-to-day business decisions.<\/span><\/li>\r\n
        • Sharing:<\/b> Reducing the likelihood or impact of a risk by transferring or otherwise sharing some of the risk. Standard techniques include purchasing insurance products, forming joint ventures, engaging in hedging transactions, or outsourcing an activity.<\/span><\/li>\r\n<\/ul>\r\n

          Considering the response to risk management<\/strong><\/h3>\r\n
            \r\n
          • The potential impact on the significance of the risk and what response options are appropriate to the organization’s risk tolerance,<\/span><\/li>\r\n
          • Separation of duties (principle) is necessary to enable risk response to achieve the desired reduction in the significance of the risk.<\/span><\/li>\r\n
          • The benefits of potential responses compared to costs should be taken into consideration.<\/span><\/li>\r\n
          • Other organization-specific focus points, if any.<\/span><\/li>\r\n<\/ul>\r\n

            References for Internal Control Articles<\/b><\/h2>\r\n
              \r\n
            • International Internal Auditing Standards, International Institute of Internal Auditors<\/span><\/li>\r\n
            • Dr. Davut Pehlivanl\u0131, Current Internal Audit Practices, Beta 2010<\/span><\/li>\r\n
            • Prof. Dr. Nejat Bozkurt, Accounting Audit, Alfa 1998<\/span><\/li>\r\n
            • Prof.Dr.Nejat Bozkurt, T\u00dcRMOB Independent Audit Training Lecture Notes, 2012<\/span><\/li>\r\n
            • Dr.\u00d6zg\u00fcr \u00c7at\u0131kka\u015f, KGK, Marmara University. Corporate Governance Lecture Notes, 2013<\/span><\/li>\r\n
            • \u0130SMMMO-Practical Information for Internal Audit in SMEs, 2013<\/span><\/li>\r\n
            • Turkish Internal Audit Institute, www.tide.org.tr<\/span><\/li>\r\n
            • Alp Buluch, Article, Internal Control, Hurses, 19 March 2013<\/span><\/li>\r\n
            • Turkish Commercial Code No. 6102<\/span><\/li>\r\n
            • International Internal Auditing Standards, www.theiia.org<\/span><\/li>\r\n
            • Treadway Commission Supporting Institutions Committee, Internal Control-Integrated Framework, 2013<\/span><\/li>\r\n
            • Public Financial Management and Control Law<\/span><\/li>\r\n
            • Public Internal Control Standards<\/span><\/li>\r\n
            • Public Internal Control Guide<\/span><\/li>\r\n<\/ul>\r\n\r\n

               <\/p>\r\n[\/vc_column_text][\/vc_column][\/vc_row]","protected":false},"excerpt":{"rendered":"

              [vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none”…<\/p>\n","protected":false},"author":2,"featured_media":1444,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[845],"tags":[951,947,952,973,954,968,974,955,975],"class_list":{"0":"post-1212","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-insights","8":"tag-corporate-governance-en","9":"tag-corporate-risk-management-en","10":"tag-coso-internal-control-en","11":"tag-defining-risks-en","12":"tag-governance-en","13":"tag-risk-analysis-en","14":"tag-risk-descriprion-en","15":"tag-risk-management-en","16":"tag-risks-in-companies-en"},"_links":{"self":[{"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/posts\/1212","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/comments?post=1212"}],"version-history":[{"count":1,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/posts\/1212\/revisions"}],"predecessor-version":[{"id":7808,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/posts\/1212\/revisions\/7808"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/media\/1444"}],"wp:attachment":[{"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/media?parent=1212"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/categories?post=1212"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/teolupus.com\/en\/wp-json\/wp\/v2\/tags?post=1212"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}