Enterprise Risk Management (ERM): Why it is Important?

Risk assessment is the process of identifying risk factors, analyzing and determining the appropriate ways to manage the risk.

Why Should the Management Incorporate Risk Assessment in their Day to Day Operations?

1. Helps identify risk
2. Helps in determining if existing controls are adequate to address the risk
3. Helps in mitigating against the risk when/if they occur (where applicable)

When Should Risk Assessment be Done?

1. Before a new process is introduced
2. Before amendments are done to the existing processes
3. When threats are identified

Procedure for Performing Risk Assessment

.

On identification risk, it is important to rank the risks. These helps to determine which risk is serious and the different approaches to be used to address the risks.

Risk Management

This refers to the application of resources to minimize, monitor, and control the probability or unfortunate events. In order to properly manage risk, it is important to take into account the organization risk appetite which in turn will help identify to be used to deal with the risk as outlined below;

Methods of Responding to Risk

1. Risk mitigation – Putting internal control measure to reduce the risk
2. Risk avoidance – Whereby the management fails to allow an action that would cause the risk to occur
3. Risk acceptance – acknowledge the risk and not take any action since the costs of mitigating are higher than the benefits.
4. Risk transfer – Shifting the risk to third party

Overtime, risk management has grown to become a very important element within an organization. This is because risks have become very complex especially due to the rapid pace of globalization. Therefore, it is important to understand the procedure undertaken in risk management as shown below;

Steps Taken in Risk Management

Role of Internal Auditor in ERM

Internal auditor has a responsibility of adding value to the organization by providing an independent assurance to the board of the effectiveness of the risk management and the internal control.