Okay, let’s dive into the Enterprise Risk Management activities.
This is where the real meat of the model resides.
Enterprise Risk Management consists of eight interrelated components as you can see across the front face of the COSO cube.
For the remainder of the course, we will spend a few minutes discussing each of these.
First up we have the Internal Environment, which is commonly referred to as the “tone at the top”.
Do you know how many frameworks begin with this notion of “tone at top”?
Well we have the: Internal Control Frameworks, Fraud Frameworks, Ethics Frameworks, and
General Computer Control Frameworks.
And there is a reason, if you look back some of the largest corporate frauds and corporate failures,
how many can be traced back to poor “tone at the top”?
Leman Brothers, Bears Stern, Washington Mutual all examples of where...
Boards and senior executives took oversized risks and manufactured...
ridulously complex financial instruments that made little sense in hindsight.
Enron, Worldcom, Nortel, Bernie Madoff - are all examples of frauds that were allowed to happen because of flaws in the Internal Environment
The bottom line is that if the "tone at the top" is cracked, the rest doesn’t matter.
But in my mind, the challenge is effectively assessing "tone at the top."
This is not easy to do, especially if you hand this off to an inexperienced manager.
The most common procedure is to work your way through a sixty page questionnaire with the senior executive team.
I’m willing to bet that this is not the most effective way at evaluating the Internal Environment.
Let’s look at the elements of the Internal Environment to get a better understanding.
First, we have the Risk Management Philosophy.
These are the beliefs and attitudes about risks taken in conducting business.
Having worked myself in both the utility industry and the entrepreneurial sector,
I’ve seen both sides of Risk Philosophy
Utilities are very regimented with their Risk Management Philosophy, it's well documented with all sorts of policies and committees
In the private world, this sort of stuff is informal at best and a lot of decisions get made from the gut
Similar to the Risk Management Philosophy is the concept of Risk Appetite.
This is the amount of risk an entity is willing to accept.
Utilities only invest in new power lines or power plants...
when they are sure they can recover these costs through the rates they charge their customers.
Entrepreneurs see opportunities and may be willing to take more risk by pulling the trigger to proceed before...
they’ve entirely figured out the business model.
Thirdly, we have Board of Directors:
These folks provide an oversight role for the entity.
To be effective, they need to challenge management;
second guess the executives to test the strategies they put forward.
To do so effectively means they themselves must be competency in the field.
Rubber stamp boards were all too common and unfortunately still exist in many entities.
Fourthly, we need to consider the Integrity and Ethical Values.
Nothing says "tone at the top" more than studying the behaviors of those in charge.
Consider how the organization sets its standards of behavior.
More importantly, what does the organization do when someone violates those standards?
Fifthly, we have Commitment to Competence.
That is, does the organization have the knowledge and skills required to fulfill assigned responsibilities?
On paper, two organizations can have exactly the same compliment of staff with exactly the same skills and experience;
however, their productivity and effectiveness can be vastly different depending on...
how well its managers are leading, motivating, and managing staff, which is an element of the Internal Environment.
Sixth, we need to consider Organizational Structure.
Organization Structure has a pervasive impact on