The Risk Management Process (Well-enlightened)

Performance Standard 2120 correct answers The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes. Risk Management correct answers - is "a process to identify, assess, manage, and control potential events or situations to provide reasonable assurance regarding the achievement of the organization's objectives" (The IIA Glossary) - Management must focus on risks at all levels of the entity and take the necessary action to manage them. - All risks that could affect achievement of objectives must be considered. - processes may be formal or informal, quantitative or subjective, or embedded in business units or centralized. - processes are designed to fit the organization's culture, management style, and objectives. Risk management processes include: correct answers (1) identification of context (2) risk identification (3) risk assessment and prioritization (i.e., risk analysis) (4) risk response (5) risk monitoring Process - Step 1: Identification of Context correct answers - A precondition to risk identification is identifying the significant contexts within which risks should be managed. - Contexts include the following: a. Laws and regulations b. Capital projects c. Business processes d. Technology e. Market risk (e.g., interest rates, foreign exchange rates, equity investments) f. Organizations Process - Step 2: Risk Identification correct answers - should be performed at every level of the entity (entity-level, division, business unit) relevant to the identified context(s) as severity can depend on level - Examples of external risk factors at the entity level include technological changes and changes in customer wants and expectations. - Examples of internal risk factors at the entity level include interruptions in automated systems, the quality of personnel hired, and the level of training provided. - should consider past events (trends) and future possibilities Process - Step 2: Risk Identification -Methods correct answers - Event inventories: use software for particular industries to provide lists that can be used as a starting point for event identification. - Questionnaires and surveys: Responses can be evaluated to identify potential events. - Leading event indicators: are measures that provide insight into potential events.