Strategic Risk Management in the Face of Uncertainty and Unexpected Risks

Strategic Risk Management in
the Face of Uncertainty and
Unexpected Risks

Vincent Tophoff, International
Federation of Accountants (IFAC)

ICAP CFO Conference

Karachi, Pakistan

March 12, 2013
Page 1 | Confidential and Proprietary Information

ICAP CFO Conference 2013

Overview

• IFAC and its PAIB Committee

• Current thinking in risk management

• Bad practice vs. good practice in risk management

• Role of CFO / PAIB in risk management

• Useful standard and guidelines

• IFAC’s work on risk management and internal control



The International Federation of Accountants (IFAC)

• The global organization of the accountancy profession
• 173 member bodies and associates in 129 countries
• 2.5 million professional accountants in public practice,
commerce, industry, financial services, the public
sector, education, and the not-for-profit sector
• Public interest focused
More than half are
in this box. We call
them PAIBs and
IFAC’s PAIB
Committee exists to
support them


What IFAC Does

• Establish and promote adherence to high quality
professional standards
• Further adoption and implementation of standards
• Support the global development of the accountancy
profession
• Provides a global voice and promotes the value of
professional accountants worldwide
• Supports professional accountants in business / CFOs
and small and medium practices



IFAC’s PAIB Committee >Topic Areas of Importance

• Governance and ethics
• Risk management and internal control
• Sustainability and corporate responsibility
• Financial and performance management
• Business reporting
• Promoting and contributing to the value of PAIBs/CFOs

All areas of critical importance to professional accountants
in business and CFOs



Global Crisis, Caused by:

• Ethical flaws
• Governance, risk & control in name but not in spirit
• Regulatory overload, leading to legalistic compliance
• Risk & control systems too narrowly focused on only
financial reporting controls
Conclusions:
• Appropriate application of risk management and internal
control standards and principles is often the problem
• Organizations should take a broader approach in risk
management and internal control.



Current thinking about risk (1)

• The safest place for a ship…

• … is to stay in the harbor
• But that’s not where ships are made for…



Current thinking about risk (2)

• Instead, ship are used to transport people and goods to
other destinations
• And that involves risk

So, what is risk?
• Risk is nowadays defined as ―the effect of uncertainty on
(achieving) the organization’s objectives‖ (ISO 31000)

• No objectives => no risk. Therefore, risk should always
be assessed in light of the organization’s objectives



Current thinking about risk management (1)

• Q: “How does your organization address uncertainty in
achieving its strategic objectives?”
• A: ―Through our strategic management system;‖
– Line management engaged in plan-do-check-act cycle
– Focused on achieving the organization’s objectives

• Q: “How does your organization address risk?”
• A: ―Through our risk management system;‖
– (separate) risk and control system, staff functionaries, risk register
– Focused on mitigating risk




What does this example tell us?

• That we, CFOs / PAIBs, have made great progress in the
area of risk management and internal control…

• …But that we, in the process, lost the other people in our
organization!

Risk Management
Rest of the Organization




Biggest risk facing an
organization: Disconnect
between those responsible for
achieving strategic objectives
vs. those responsible for
managing risk

Solution: making those
responsible for achieving
strategic objectives also
responsible for managing
related risks!



• Line management is accountable for (achieving) the
organization’s objectives,
• This also includes responsibility for managing the effects of
risk on those objectives

Key objective for CFOs / PAIBs in this regard:
• Ensure that risk management and internal control are fully
integrated in the line management of an organization!



Bad Practice vs. Good Practice in Risk Management

Overwhelming load of bad practice
• RM/IC as objective in itself vs. RM/IC to achieve objectives
• Auditor / staff driven vs. Board and management driven
• Rules-based vs. Principles-based
• Of the shelf systems vs. Tailor made
• Focused on threats only vs. Also focused on opportunities
• Mainly hard controls vs. Social / human aspects
• Artificially implemented vs. Organically implemented
• Stand alone / ―bolt-on‖ vs. Integrated / ‖built-in‖
• Static, out-of-date vs. Dynamic, evolving
• Creates costs vs. Creates results / value
• Abandoned vs. Supported



Bad Practice vs. Good Practice in Risk Management (2)

or

Hindering the Enabling the
organization organization
• Good risk management & internal control: invisible hand



Role of the PAIB / CFO in Risk Management (1)

PAIB / CFO plays many important roles in implementing
good risk management in organizations:
A. Championing the importance of good risk management

B. Supporting line management through the provision of
high-quality information

C. Establishing risk management for the finance function




A. Championing the importance of good risk management
• CFOs and many PAIBs are in leadership positions

• Attitude and behavior of the CFO / PAIB sets tone for good
risk management and internal control in the organization

• Integrating risk management and internal control into the
line management of an organization!

• Most important element: making risk management part of
every decision making process in the organization (SWOT)



B. Supporting line management through the provision of
high-quality information
• Decisions should not be taken without explicit understanding
of the related risks and their potential consequences for
achieving an organization’s objectives

• Therefore, decision makers require relevant and reliable
information for their decision making and control processes

• CFO / PAIB responsible for provision of high-quality
information produced through the finance & control system




C. Establishing risk management for the finance function
• CFOs / PAIBs usually are specifically accountable for
finance and control

• Therefore, CFOs / PAIBs should make risk management
part of every decision related to achieving the
organization’s finance objectives

• CFOs / PAIBs usually also involved in analyzing of and
reporting on the organization’s (risk management and
internal control) achievements



ICAP and IFAC Supporting the PAIB / CFO

Together, ICAP and IFAC’s PAIB Committee support
PAIBs / CFOs through:
• Collaborating with regulators and standard setters in area
of governance, risk management, and internal control

• Developing additional guidance for PAIBs / CFOs

• Bringing together resources for PAIBs / CFOs

• Levering knowledge for PAIBs / CFOs through various
channels, such as this CFO conference


IFAC Collaboration with COSO

• Committee of Sponsoring Organizations of the Treadway
Commission (COSO)

• Providing thought leadership through the development of
frameworks and guidance on risk management and
internal control

• Revised Framework expected in April 2013 and available
at www.coso.org



COSO Framework



IFAC Collaboration with ISO 31000

• International Standards Organization (ISO) developed the
standard ISO 31000:2009 Risk Management

• Can be used by any public, private or community
enterprise, association, group, or individual

• Can be applied to any type of risk, whatever its nature,
whether having positive or negative consequences



ISO 31000 Risk Management Principles

• Creates value
• Integral part of organizational processes
• Part of decision making
• Explicitly addresses uncertainty
• Systematic, structured and timely
• Based on the best available information
• Tailored
• Takes human and cultural factors into account
• Transparent and inclusive
• Dynamic, iterative and responsive to change
• Facilitates continuous improvement



ISO 31000 Risk Management Framework

Mandate and Commitment

Design of Framework

Continual Improvement Implementing Risk
of Framework Management

Monitoring and review of
Framework



ISO 31000 Risk Management Process

Establishing the Context
Communication and Consultation

Risk Assessment

Monitoring and Review
Risk Identification

Risk Analysis
To be applied in
every decision
Risk Evaluation making process

and subsequent
Risk Treatment execution!


IFAC Risk Management & Internal Control
> Publications

• Evaluating and Improving Governance in Organizations

• Evaluating and Improving Internal Control in Organizations

• Integrating Governance in for Sustainable Success

• All IFAC Publications free-of-charge at www.ifac.org


Evaluating and Improving Internal Control in
Organizations

• Highlighting areas where practical application of internal
control standards often fails in many organizations

• Designed to establish a benchmark for good practice in
maintaining effective internal control in response to risk

• For all types of organizations, as all organizations—whether
private or public—should have appropriate internal control


Guidance Principles
> Good Internal Control Should:

• Support the organization’s objectives
• Define clear roles and responsibilities
• Foster a motivational culture
• Link to individual performance
• Ensure sufficient competency
• Respond to risk
• Be communicated regularly
• Be monitored and evaluated regularly
• Provide for accountability and transparency


Next steps
> Guidance in integration of risk & control

• Risk management and internal control are a means to an
end: making sound (SWOT) decisions to achieve the
organization’s objectives without surprises!

• Principles on how CFOs / PAIBs can support their
organization integrating risk management and internal
control into the organization’s overall governance and
management system



Conclusions (1)

• Risk is the effect of uncertainty on (achieving) the
organization’s objectives
• Strategic (risk) management is primarily about achieving
the organization’s objectives, while addressing risk
• Many flaws in current risk management practice
• PAIBs / CFOs support strategic (risk) management in their
organizations in various ways
• ICAP and IFAC support PAIBs / CFOs

• However, no matter the guidance provided…



Conclusions (2)

• …There will always be some who do it their own way!


Strategic Risk Management in the Face of Uncertainty
and Unexpected Risks

Questions?
• Many thanks for your interest
• Happy to answer your questions


• For further information please contact:
• Vincent Tophoff at vincenttophoff@ifac.org
• Visit www.ifac.org


Strategic Risk Management in the Face of Uncertainty and Unexpected Risks

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (16)

Similaire à Strategic Risk Management in the Face of Uncertainty and Unexpected Risks

Similaire à Strategic Risk Management in the Face of Uncertainty and Unexpected Risks (20)

Plus de International Federation of Accountants

Plus de International Federation of Accountants (20)

Dernier

Dernier (20)

Strategic Risk Management in the Face of Uncertainty and Unexpected Risks