Showing posts with label audit. Show all posts
Showing posts with label audit. Show all posts

Monday 8 February 2016

What every Risk Manager should be asking himself

By Stanley Epstein

The whole aspect of Risk Management has taken on a much higher profile over the past few years, driven by many new factors. In the financial industry the crisis that so unpleasantly arrived on our doorstep in 2008 has been a major catalyst while other recent events such as 9/11, the Japanese Tsunami linked to the Fukushima atomic incident, hurricane Katrina and hurricane Sandy, have each, in their own way added to the knowledge of and the pressure to be more aware of risk and to take positive steps to better manage these.

One of the most important aspects of risk management lies in the creation the correct culture within the organization. In this short article I pose ten questions aimed specifically at Risk Managers. If you can answer “yes” to all of these you have created the appropriate risk management culture. The more “no’s” you have on your list the more work you need to do.


1. Have you identified the potential business risks to the organization?

The starting point of any risk management program is to obtain a clear understanding of all the potential risks that face the firm. The emphasis is on ALL the risks. Remember operational risks become business risks as well. 

2. Have you assessed the likelihood and consequence of the significant risk being realized?


There are risks and there are risks. Once you have established what risks face your organisation the next step is to determine what are the chances of such risks being realised as well as what effect such an occurrence will have on the business or operation.

3. Have you assessed those risks that could:
  • Damage your organization’s reputation?
  • Affect your organization’s market position?
  • Result in prosecution?
We often tend to focus on the financial risks only. However risks are always much wider than just the lost of income or the added expense of replacing a server. You need to give serious thought to the risks that could affect your organisation in the wider scheme of things. Reputation, market position and the threat of prosecution, just to name but three. A current example is the “horse-meat” scandal that is sweeping across Europe.

4. Have you established controls to manage significant business risks?

Of course it is impossible to eliminate all risks that the firm faces. Yet there is a very significant range of risks that your business is exposed to regularly. The starting point in managing these risks is to make certain that the right controls are in place to do just this.

5. Have you established a positive culture for controlling the risks?

Although risk represents a danger to the firm and a potential loss, risk should be seen in a positive light as an issue that you need to be aware of and that needs to be managed. A positive culture in managing risks is based on ensuring knowledge and understanding of what risk is, its implications and how it is managed or mitigated. This culture is further enhanced by ensuring that ALL the organisation’s staff receive the appropriate training.

6. Have you established a contingency plan to mitigate disaster?

What would you do, if tomorrow morning, you were faced with a situation in which you were unable to open your business? The reason why is largely irrelevant. The real disruption would be that you would be unable to open for business. Contingency planning is exactly how you would overcome this unfortunate situation and be able to continue operations/ serving your customers. Do you have a Business Continuity Management plan that covers everything? Has it really been tested? Will it work?

7. Have you established continuity management control arrangements?

Business continuity management control addresses an organization’s ability to offset interruptions to normal operations. Key elements of this include;
  • Business continuity planning – a business continuity strategy based on a business impact analysis.
  • Business continuity testing – testing and documentation of business continuity strategy.
  • Business continuity maintenance – identifies ownership of business continuity strategy as well as ongoing reassessment and maintenance.
8. Do you regularly audit compliance with control arrangements?

It is one thing to have a comprehensive set of control arrangements to help mitigate the various risks. But this does not mean that you have managed your risks effectively. Are control arrangements being complied with? Compliance auditing will help keep this in check.

9. Do you regularly review these arrangements with respect to their adequacy and effectiveness?

Nothing remains static over time. What was true today need not necessarily be so tomorrow. The same applies to control arrangements. New processes, new operations, new clients all subtly change the risks you face. And with this change comes the need to ensure that the controls that you have put in place remain adequate and effective always.

10. Do you report annually on your risk and control measures?

Is there a higher body that keeps a watching brief over the businesses risks, the risks that you manage and you control measures? Do you report regularly to someone on these issues? You should be …. and you should be doing this at the very least annually.

At the start of this article I wrote that a positive answer to each of the ten questions posed above would indicate that you, as a Risk Manager, have created an appropriate risk management culture. But culture is not enough. That culture has to lead to effective risk management. You do this in the doing, in showing positive results, in bringing down risks faced by the business, in reflecting a positive financial outcome.

Of course this is just the beginning to creating an effective risk management program. Acquiring the knowledge and the expertise is the next step on Risk Management ladder. 

Remember – risk management is a journey, not a destination!

The fun stuff is yet to come!

Monday 22 June 2015

Mystery shopping firms go on espionage trip, help banks streamline work


From DNA –

“A growing tribe in the country - mystery shopping companies - are helping banks undertake covert audits on employees and branches to ensure that they strictly adhere to the rule book, prevent money laundering, and improve customer services.

'Mystery shoppers' pose as potential customers.

About 20% audits done by banks are focused exclusively on monitoring anti-money laundering (ALM). This number is expected to rise with banks stepping their antennae to intercept black money.”

Read more>>

Tuesday 16 June 2015

What Audit and Risk Committees Face Now


From Bank Director –

There are many challenges that bank boards and executives must address.



Wednesday 10 June 2015

Bank calls in auditors over FIFA scandal


From Cayman News Service –

“Fidelity Bank has called in auditors in the wake of allegations made by the US authorities that it may have played a part in the possible laundering of the alleged bribes and kickbacks at the centre of the FIFA scandal. Officials from Fidelity said they had “engaged Deloitte Cayman to conduct an independent review of the Bank’s internal processes and policies to confirm that they are in line with regulatory requirements.”

In a press release issued on Monday, the bank said it has consulted with the Cayman Islands Monetary Authority (CIMA) regarding the internal review and the regulator will contribute to the preparation of the Terms of Reference for the work “to ensure that the review covers any questions that CIMA may have”, the bank stated.”

Read more>>




 
Website Statistics mortgage payment calculator