Controls are the activities Schwan puts into place to manage or mitigate the risks. Controls are often built into the core business processes and support processes (see Exhibit 7 for a graphical representation of the risk assessment framework).
Within each process, the internal audit personnel assess gross risk (threats or impediments to the accomplishment of corporate or process objectives), the strength of relevant controls and of management’s response to the identified risks, and residual risk (a re-evaluation of risk in light of controls and management’s response). At the end of this process, residual risks are compared to gross risks for reasonableness. See Exhibit 8 for a graphical representation of this risk assessment.
The risks are rated based on the magnitude of the impact to the organization of the risk occurring, as well as on the probability of occurrence. Residual risk assessments are conducted through focused interviews with multiple levels of management, a review of business plans, analysis of financial and operational reports, and a review of miscellaneous information (e.g., industry information, etc.). For validation, the assessment results are discussed with the appropriate levels of management.